WordPress Prime Mover CVE-2026-115806: An Anonymous Comment, Triggered by the Next Backup (9.8)

NVD published CVE-2026-115806 on October 24, 2026. It affects Prime Mover – Backup and Migration, a WordPress plugin for backing up and moving sites, in every version up to and including 2.2.1.

PHP object injection is common in WordPress plugins. This one stands out for two reasons:

• the attacker needs no account: a plain comment is enough to plant the payload;
• the gadget chain ships with the plugin itself, so no other plugin or theme has to be present.

And the trigger is as mundane as it gets: an administrator running a backup or a restore.

The vulnerability

The score comes from Wordfence as the CNA. NVD hasn't analyzed the entry or published CPE configurations yet. It is not in CISA KEV as of writing.

How it works, in three steps

1. The drop: a comment

An anonymous visitor posts a comment through WordPress's standard form (wp-comments-post.php). The body is a base64-encoded serialized PHP object, stored as-is in the comment_content column of wp_comments.

Nothing happens yet. As far as WordPress is concerned, it's just a comment.

2. The trigger: a backup

During an export or restore, Prime Mover runs the database through a search-and-replace routine (recursiveUnserializeReplace()), the part that rewrites URLs and paths when a site moves. That routine base64-decodes values and hands the result to unserialize() with no allowed_classes restriction.

The attacker's object gets rebuilt in memory, inside an operation an administrator started.

3. The chain: Freemius, bundled in the plugin

Object injection only does damage if some loaded class offers a usable gadget chain (POP chain) — we went through this with LearnPress. Here, the NVD description names it: it lives in the Freemius library that Prime Mover bundles, and runs from FS_Clone_Manager::__set down to update_option().

update_option() writes to WordPress's options table, and on a WordPress site, controlling options means controlling the site's configuration (for instance, the default role given to new sign-ups, or whether sign-ups are open at all). The NVD description stops at update_option(); going from there to a full takeover is our reading of what that primitive allows, consistent with Wordfence's 9.8.

The UI:N paradox

The vector says UI:N (no user interaction), yet exploitation waits for an administrator to run a backup or restore. That's defensible: the admin isn't doing anything unusual and has no way to see the trap. The practical consequence is what matters: exploitation can happen long after the drop, at the next scheduled backup or the next migration. A comment planted weeks ago may still be sitting in the database.

Affected versions

NVD (via Wordfence) lists all versions up to and including 2.2.1, with no fixed version. Check the plugin's changelog on WordPress.org and the Wordfence entry linked from NVD before you treat any release as safe.

wp plugin list --name=prime-mover --fields=name,status,version

Detection

• Suspicious comments: a body made of one long base64 string, usually with no spaces, which decodes to something starting with O: or a: (PHP serialization format). That includes comments pending moderation and in spam: they're stored in wp_comments too.
• Options changed with no admin action behind them, especially users_can_register and default_role.
• New administrator accounts or unexplained role changes right after a backup or restore.
• Access logs: bursts of POST requests to wp-comments-post.php from a single IP.

SELECT comment_ID, comment_date, comment_approved, LEFT(comment_content, 80)
FROM wp_comments
WHERE comment_content REGEXP '^[A-Za-z0-9+/=]{200,}$';

(Adjust the table prefix if your site doesn't use wp_.)

Mitigation

1. Find the sites running Prime Mover.
2. Update past 2.2.1 as soon as a fixed release ships; until then, deactivate the plugin and pause any backups or migrations that rely on it.
3. Before any backup or restore on a vulnerable version: empty spam and pending comments, and check approved ones with the query above. That's our recommendation, not the vendor's — it targets the drop vector NVD describes.
4. A backup archive made from a booby-trapped database carries the comment with it: restoring it with a vulnerable plugin version, on the same site or elsewhere, exposes you to the trigger again.
5. If the site doesn't use comments, closing them removes the drop point.

Why continuous monitoring of your WordPress plugins matters

A backup plugin gets installed "once and for all" and rarely looked at again. Here, it's the very thing that turns an anonymous comment into a change to the site's configuration — right when you think you're putting your data somewhere safe.

With cveo.tech, inventory the plugins on your WordPress sites with their versions, and get an alert as soon as a critical CVE hits one of them.