External risk intelligence

WordPress Prime Mover Plugin PHP Object Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-115806

The vulnerability exists in a WordPress plugin that leverages the standard public-facing comment submission endpoint for initial input. Because WordPress sites are commonly deployed as public-facing web applications and the attack vector utilizes a standard, exposed web submission path, the vulnerable component is likely to be reachable from the internet.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Prime Mover – Backup and Migration plugin for WordPress, impacting all versions up to 2.2.1. This issue allows an unauthenticated attacker to execute malicious code on a WordPress site, potentially leading to a complete compromise of the system. The vulnerability stems from how the plugin handles user-submitted data during migration operations, enabling attackers to inject harmful code through comment submissions.

A plugin flaw allows unauthenticated attackers to inject code.
Critical risk to WordPress sites from unauthenticated attackers.
Confirm exposure and assess impact on business operations.

Attack Path

How an attacker could exploit the issue

An attacker can inject malicious code by submitting a specially crafted comment containing a serialized PHP object. This object is stored in the database and later processed by the Prime Mover plugin during an export or restore operation. The plugin's deserialization function, lacking proper restrictions, can then execute arbitrary code through a chain of existing functions within the plugin's bundled library, leading to a compromise of the website.

Unauthenticated comment submission required.
Plugin export or restore triggers deserialization.
Leads to arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious PHP objects into a WordPress site. When an administrator performs a backup or restore operation using the affected plugin, these objects could be deserialized, potentially leading to the execution of arbitrary code on the server. This could compromise the entire WordPress installation.

Compromise of WordPress site and server.
Injection via comment submission endpoint.
Arbitrary code execution and data theft.

Operational Fix

Recommended remediation, mitigation, and detection steps

Website administrators and platform teams are likely responsible for addressing this vulnerability in the Prime Mover plugin. The initial focus should be on identifying all WordPress instances utilizing this plugin, assessing their exposure and business criticality, and confirming the accountable owner. Subsequent actions will involve planning and executing remediation, potentially coordinating with the plugin vendor or implementing temporary risk-reduction measures if immediate patching is not feasible.

WordPress site owners should own the issue.
Verify plugin usage and exposure.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Prime Mover plugin used for?

Prime Mover is a WordPress plugin designed to assist site administrators with backup, migration, and cloning tasks. It facilitates moving entire WordPress installations between different environments by packaging site data, files, and database content into portable formats for export or restoration.

What is PHP Object Injection and how does it affect CVE-2026-115806?

This is a vulnerability classified as CWE-502 (Deserialization of Untrusted Data). It occurs when an application takes serialized user input and turns it back into a PHP object without safety checks. Because the plugin includes a library with pre-existing code structures, an attacker can manipulate these objects to force the application to perform unintended actions, effectively gaining control over the server.

How does an attacker trigger this vulnerability?

An attacker submits a crafted, malicious serialized object within a standard comment on the site. Simply submitting the comment does not execute the attack; the malicious code only triggers when a site administrator performs an export or restoration process using the Prime Mover plugin. If no administrative backup or migration actions are taken, the stored object remains dormant.

Why should I care about this if my WordPress site is internal?

Halo Surface Signal indicates the risk is high because the plugin uses the standard, public-facing comment submission endpoint to accept the initial malicious input. While internal sites face less external pressure, the vulnerability is reachable from the internet on typical WordPress installations. Sites that allow comments from any visitor are at the highest risk.

Do I need to do anything if I run this plugin?

Yes. First, confirm if you have the Prime Mover plugin installed and identify which sites are running versions 2.2.1 or earlier. Since the vulnerability requires administrative action to trigger, audit your site for unauthorized or suspicious comments that might contain injected data. Prioritize these sites for updates or removal of the plugin until a secure version is available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.