Prime Mover CVE-2026-115806: a WordPress comment can plant a PHP object injection that fires on export

A critical PHP object injection in Prime Mover – Backup and Migration, a WordPress plugin by Codexonics with more than 10,000 active installations, was published as CVE-2026-115806 on 24 October 2026. Wordfence, which assigned the CVE, scores it 9.8 (CVSS 3.1).

How the attack works

The flaw is two-staged, which makes it unusual:

1. The write. An unauthenticated visitor submits a normal comment through wp-comments-post.php. The comment text holds a base64-encoded, serialized PHP object. WordPress stores it in wp_comments like any other comment; no account is needed.
2. The trigger. Later, when an administrator runs a routine Prime Mover export or restore, the plugin's search-and-replace routine (recursiveUnserializeReplace()) base64-decodes that stored value and passes it to unserialize() without an allowed_classes restriction.

The gadget chain needed to abuse this ships inside the plugin itself: the bundled Freemius SDK provides a property-oriented programming chain (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()) that lets the injected object overwrite WordPress options. No second plugin or theme is required.

Migration plugins are repeatedly hit by this class of bug because they must unpack and repack serialized data across the whole database to swap domains, so text written by strangers ends up being deserialized. A similar comment-based issue affected Duplicator just days earlier.

Who is affected

• All Prime Mover versions up to and including 2.2.1.
• According to wordpress.org version stats reported on 24 October, roughly 49% of installs were still on the 2.1 branch or older.
• No in-the-wild exploitation or public exploit was reported as of 24 October, and the CVE is not in CISA's KEV catalog.

What to do

• Update to Prime Mover 2.2.2 or later (released 19 October). It restricts unserialize() to stdClass only and ships an updated Freemius SDK.
• Be aware that deactivating the plugin removes the vulnerable code path but does not remove payloads already stored in comments. Comment moderation doesn't stop storage either, since held comments are still written to the database.
• If you can't update right away, deactivate Prime Mover, consider disabling public comments, and search wp_comments for suspicious base64-encoded serialized strings before running any export or restore.
• After updating, review recently changed rows in wp_options if you ran an export or restore on an older version.

The bigger lesson for PHP code

Calling unserialize() on anything that may contain user input is a long-standing PHP footgun. If you maintain custom plugins or legacy PHP apps, use json_decode() for data exchange, or at minimum pass ['allowed_classes' => false] (or an explicit allowlist) to unserialize().

If you're running older WordPress plugins or custom PHP code that still deserializes untrusted data, RescuePHP can audit it and patch it safely, including on legacy PHP versions that can't be upgraded overnight.

Sources: CVE record, Codexonics 2.2.2 release notes, Dr. Web