# CVE-2026-115806 - Prime Mover \<= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace

DevFeed: [CVE-2026-115806 - Prime Mover \<= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace](<https://devfeed.tech/articles/cve-2026-115806-prime-mover-2-2-1-unauthenticated-php-object-injection-via-base64-encoded-comment-during-migration-search-and-replace-98659.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-115806>)

Author: CVEFEED.io; wordfence.com

Published: 2026-10-24T05:17:04Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [Object-oriented programming (OOP)](<https://devfeed.tech/topics/oop.md>), [object](<https://devfeed.tech/topics/object.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [administrator](<https://devfeed.tech/tags/administrator.md>), [allowed](<https://devfeed.tech/tags/allowed.md>), [backup](<https://devfeed.tech/tags/backup.md>), [base64](<https://devfeed.tech/tags/base64.md>), [comment](<https://devfeed.tech/tags/comment.md>), [content](<https://devfeed.tech/tags/content.md>), [cve-2026-115806](<https://devfeed.tech/tags/cve-2026-115806.md>), [export](<https://devfeed.tech/tags/export.md>), [input](<https://devfeed.tech/tags/input.md>), [library](<https://devfeed.tech/tags/library.md>), [migration](<https://devfeed.tech/tags/migration.md>), [object](<https://devfeed.tech/tags/object.md>), [option](<https://devfeed.tech/tags/option.md>), [php](<https://devfeed.tech/tags/php.md>), [plugin](<https://devfeed.tech/tags/plugin.md>), [post](<https://devfeed.tech/tags/post.md>), [programming](<https://devfeed.tech/tags/programming.md>), [property](<https://devfeed.tech/tags/property.md>), [search](<https://devfeed.tech/tags/search.md>)

## AI overview

Prime Mover - Backup and Migration versions through 2.2.1 are described as vulnerable to unauthenticated PHP object injection during migration search-and-replace. An attacker can submit a crafted base64-encoded serialized object as comment content; during a later administrator export or restore, the plugin decodes it and calls unserialize() without an allowed_classes restriction. The description identifies a POP chain in the bundled Freemius library, so it says no additional plugin or theme is needed. The excerpt reports CVSS 9.8 (critical); it does not identify a fixed version.

## Source excerpt

CVE ID :CVE-2026-115806 Published : Oct. 24, 2026, 5:17 a.m. | 1 hour, 43 minutes ago Description :The Prime Mover - Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set -> FS_Option_Manager::set_option -> store() -> update_option()), so no additional plugin or theme is required -- the plugin ships the gadget itself. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...