CVE advisoryCRITICAL
CVE-2026-115806
WordPress Prime Mover Plugin PHP Object Injection
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The Prime Mover WordPress plugin has a PHP Object Injection vulnerability, allowing unauthenticated attackers to execute arbitrary code by submitting crafted comments that are later processed during plugin operations. This could lead to a compromise of the WordPress site.