PHP Object Injection Vulnerability in Prime Mover Backup and Migration Plugin for WordPress
CVE-2026-115806
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 24 October 2026
What is CVE-2026-115806?
The Prime Mover – Backup and Migration plugin for WordPress contains a vulnerability that allows for PHP Object Injection. This flaw occurs through the deserialization of untrusted input in the migration search-and-replace routine. Attackers can exploit this vulnerability by submitting a base64-encoded serialized object through wp_comments.comment_content. During regular export or restore operations, the plugin decodes and unserializes this malicious input without any restrictions on allowed classes. This flaw is facilitated by a Property-Oriented Programming (POP) chain present in the plugin's bundled Freemius library, which means that the necessary exploitation tools are included within the plugin itself, negating the need for additional plugins or themes.
Affected Version(s)
Prime Mover – Backup and Migration 0 <= 2.2.1