Zero Radar
← feed
CriticalVulnerabilityCVE-2026-115806updated 25 Oct 2026, 17:20 UTC

Prime Mover WordPress backup plugin: unauthenticated code-execution risk via comments

Attackers can hide a specially crafted message in a normal blog comment. When an administrator later runs a backup or restore with this plugin, the plugin can be tricked into running that hidden message as code on the website's server.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker posts commentComment holds encoded serialized object
  2. 2Stored in databaseSaved in wp_comments.comment_content
  3. 3Admin runs backupRoutine export or restore triggers the flaw
  4. 4Unsafe unserialize()Plugin decodes and deserializes the data
  5. 5Code runs on serverBundled Freemius library completes the chain
  6. ResultAttacker controls the WordPress server

What happened

Prime Mover – Backup and Migration plugin for WordPress (all versions up to and including 2.2.1) unsafely calls unserialize() on base64-decoded data stored in wp_comments.comment_content during its search-and-replace routine (recursiveUnserializeReplace()), enabling PHP Object Injection. A POP chain in the plugin's bundled Freemius library makes the flaw exploitable without any other plugin.

Why it is dangerous: An unauthenticated attacker can potentially take control of the WordPress server, read or change site data, and install malware. Any site running the affected plugin where an administrator uses export or restore is at risk.

Are you affected?

You are affected if you run the Prime Mover – Backup and Migration plugin for WordPress version 2.2.1 or older and allow public comment submission.

Prime Mover – Backup and Migration plugin for WordPress, all versions up to and including 2.2.1

What to do

  1. Check whether Prime Mover is installed and which version; treat version 2.2.1 or older as vulnerable.
  2. Check the plugin's official page or the advisory for a patched release and update as soon as one is available.
  3. Until a fix is installed, deactivate or remove the Prime Mover plugin, or disable public comments.
  4. Review existing comments for unusual base64-encoded or serialized content and check the server for unexpected files.

Timeline

  1. 24 Oct 2026, 05:17 UTC
    Publicly disclosed
  2. 24 Oct 2026, 05:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 17:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-115806 · GHSA-g589-p4qg-x28q
CVSS
9.8 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
24 Oct 2026, 05:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Prime Mover WordPress backup plugin: unauthenticated code-execution risk via comments · Zero Radar