CVE-2026-115806

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 2.2.1 . The flaw exists in the recursiveUnserializeReplace() routine within the migration search-and-replace functionality. An unauthenticated attacker can inject ...

CVE-2026-115806 Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine recursiveUnserializeReplace. An unauthenticated attacker can store a...