SECURITYCRITICALCVE-2026-115806

CVE-2026-115806: Prime Mover Backup and Migration Plugin — Critical PHP Object Injection

A CVSS 9.8 PHP Object Injection flaw in the Prime Mover WordPress plugin (2.2.1 and earlier) lets unauthenticated attackers abuse unsafe deserialization.

Dylan H.

Security Team

October 24, 2026
2 min read
CVE-2026-115806: Prime Mover Backup and Migration Plugin — Critical PHP Object Injection

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Prime Mover – Backup and Migration plugin for WordPress ≤ 2.2.1

Executive Summary

A critical PHP Object Injection vulnerability has been published for the Prime Mover – Backup and Migration plugin for WordPress. Tracked as CVE-2026-115806 with a CVSS score of 9.8, it affects all versions up to and including 2.2.1.

According to the NVD description, the flaw lies in the migration search-and-replace routine (recursiveUnserializeReplace()), which deserializes untrusted input. An unauthenticated attacker can store a crafted payload that is later deserialized. The published description is truncated in our feed, so consult the NVD entry for the full exploitation conditions.

Vulnerability Overview

AttributeValue
CVE IDCVE-2026-115806
CVSS Score9.8 (Critical)
TypePHP Object Injection (CWE-502, deserialization of untrusted data)
AuthenticationNone required
Affected PluginPrime Mover – Backup and Migration
Affected VersionsAll versions up to and including 2.2.1
Vulnerable FunctionrecursiveUnserializeReplace()
Published2026-10-24

Why It Matters

PHP Object Injection becomes dangerous when a usable "gadget chain" exists in the plugin or another installed component. Depending on the chain, impact can range from arbitrary file deletion to remote code execution. Whether a chain is present in a given site depends on its other plugins and themes.

Affected Versions and Patches

ComponentAffected VersionsStatus
Prime Mover – Backup and Migration≤ 2.2.1Check the plugin repository for a fixed release

Remediation

  1. Update Prime Mover to the latest release as soon as one newer than 2.2.1 is available.
  2. If no fixed release exists, deactivate and remove the plugin, particularly on internet-facing sites.
  3. Review sites for unexpected admin users, modified files, and new scheduled tasks.
  4. Deploy WAF rules that inspect for serialized PHP object patterns in request bodies.
  5. Take backups before changes, and store them off the web server.

Key Takeaways

  1. CVSS 9.8 with no authentication required
  2. Every version through 2.2.1 is affected
  3. Backup and migration plugins handle sensitive data and are high-value targets
  4. Treat it as urgent on any site running the plugin

References