CVE-2026-115806 Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine recursiveUnserializeReplace. An unauthenticated attacker can store a...

EUVD-2026-109213

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine recursiveUnserializeReplace. An unauthenticated attacker can store a...

CVE-2026-115806

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 2.2.1 . The flaw exists in the recursiveUnserializeReplace() routine within the migration search-and-replace functionality. An unauthenticated attacker can inject ...

freemius-exploit

freemius-exploit Freemius Library 2.2.4 - Subscriber+ Arbitrary Option Update Description The library, used in numerous plugins, does not have proper authorization when updating blog options, allowing any authenticated users, such as a subscriber, to update arbitrary options. Usage usage:...

Multilist Subscribe for Sendy <= 1.6.1 - Subscriber+ Arbitrary Options Update

The plugin is using an outdated version of the Freemius library 1.2.2.9, which is known to be affected by a security issue allowing any authenticated users, such as subscriber to set arbitrary blog options PoC As any authenticated user: Enable new user registrations:...

Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update

Description The library, used in numerous plugins, does not have proper authorisation when updating blog options, allowing any authenticated users, such as subscriber to update arbitrary options As any authenticated user: Enable new user registrations:...