Prime Mover Vulnerability (CVE-2026-115806): Update to 2.2.2 Before Your Next Migration

Prime Mover is a WordPress backup and migration plugin with more than 10,000 active installs. CVE-2026-115806, published October 24, is the kind of bug that's easy to miss: nothing happens when the attacker sends it. It sits in your database until you do something routine.

The fix has been out since October 19, in Prime Mover 2.2.2. If you're on 2.2.1 or earlier, update before you run another export, backup or restore.

It's a PHP object injection bug (CWE-502, deserialization of untrusted data). According to the CVE record:

1. An attacker who doesn't need an account submits a comment through the normal WordPress comment form (wp-comments-post.php). The comment holds a base64-encoded serialized PHP object.
2. Later, an administrator runs an ordinary Prime Mover export or restore.
3. During its search-and-replace step (recursiveUnserializeReplace()), the plugin base64-decodes that stored value and passes it to PHP's unserialize() with no allowed_classes restriction. That turns the attacker's text back into a live object.

The usual saving grace with object injection is that the attacker needs a "gadget chain," code already on the site that does something dangerous when the object loads. Here, the CVE record says the chain is in the Freemius library that Prime Mover bundles. No other plugin or theme is needed, because the plugin brings its own.

Wordfence, which assigned the CVE, rates it CVSS 3.1 9.8 (Critical): network, low complexity, no login, no user interaction. WPScan lists it at 9.8 too.

You are if Prime Mover 2.2.1 or earlier is installed and comments are open on the site. Check the version:

wp plugin get prime-mover --field=version

Or look under Plugins in the admin. The CVE covers "all versions up to, and including, 2.2.1." If you run Prime Mover PRO, check its version the same way.

The attack only goes off when an admin runs Prime Mover's export or restore. If you installed it once for a migration and haven't touched it since, the risk comes from the next time you do. That's often a hurried moment like a host move or a restore after a problem.

1. Update to Prime Mover 2.2.2 or later.

wp plugin update prime-mover

Plugin auto-updates aren't on by default in WordPress, so don't assume it already happened.

2. Don't run an export or restore on 2.2.1 or earlier. Update first. If a migration is in progress, finish updating both the source and destination sites before you continue.

3. If you don't use it, remove it. A migration plugin left behind after the move is just attack surface.

wp plugin deactivate prime-mover && wp plugin delete prime-mover

4. Look for planted comments. A serialized PHP object starts with O:, and base64 of that starts with Tz. A comment that's just one long base64 string is worth a look. Check pending and spam comments too, since those rows sit in the same table:

wp db query "SELECT comment_ID, comment_approved, comment_date, LEFT(comment_content, 80) FROM $(wp db prefix)comments WHERE comment_content REGEXP '^[A-Za-z0-9+/]{40,}={0,2}$'"

This is a rough filter, not a detector, so look at what it finds before you delete anything. Emptying your spam folder is a quick way to shrink the pile either way.

5. If you already ran an export or restore on an old version, treat it as a possible compromise. Run the checks in my WordPress audit checklist after a plugin compromise: users, plugins on disk, file checksums, cron jobs and recent PHP files.

The Codexonics changelog lists "Hardened unserialize implementation to prevent object injection," credited to Civitasmass via Wordfence, along with an updated Freemius SDK. Codexonics's release post says the plugin's unserialize() calls now allow only stdClass objects, which some page builders, such as Beaver Builder, need.

There's one side effect worth knowing about. If a plugin stores URLs or file paths inside a custom serialized object, Prime Mover 2.2.2's search-and-replace now skips them, so those URLs won't update during a migration. Codexonics says that's rare and suggests fixing them by hand afterward with the Better Search and Replace plugin. After your next migration, click through any custom post types or page-builder pages to make sure their links point to the new domain.

• The scores don't agree. Wordfence and WPScan say 9.8 Critical. WPSec rates its own advisory for the same bug 7.5 High, because it counts the admin's export as user interaction. It also says no gadget chain exists in the plugin itself. The CVE record, which comes from Wordfence, says one does, in the bundled Freemius library. I'd plan around the higher number.
• No public exploitation reports yet. As of October 24, I haven't seen any reports of attacks, and OpenCVE shows it isn't on CISA's Known Exploited list. The write-up names the exact files and lines, so that could change quickly.
• Some trackers are behind. Patchstack's Prime Mover page didn't list this CVE yet when I checked, and a couple of aggregators still show "no fix." The WordPress.org changelog is the source of truth, and it lists the fix in 2.2.2.

Update Prime Mover everywhere it's installed, and delete it anywhere it's just left over from an old move. Backup and migration plugins read and rewrite your whole database, which is exactly why a bug like this turns a comment into a problem. If you're already going through your WordPress sites after this month's UpdraftCentral and Rank Math incidents, add Prime Mover to the list.

If you run WordPress for a small business and want someone to check your plugins and migration setup, that's work I take on. Get a free quote and tell me what you're running.

Which Prime Mover version fixes CVE-2026-115806?

Prime Mover 2.2.2, released October 19, 2026. All versions up to and including 2.2.1 are affected.

Does an attacker need an account?

No. According to the CVE record, the payload goes in through the standard WordPress comment form, which doesn't need a login on most sites. It only runs when an administrator later performs a Prime Mover export or restore.

Is CVE-2026-115806 being exploited?

No attacks had been publicly reported as of October 24, 2026, and OpenCVE shows it isn't on CISA's Known Exploited Vulnerabilities list. Update anyway, because the bug is easy to reach and the details are public.

What CVSS score does the Prime Mover vulnerability have?

Wordfence, the CVE assigner, rates it 9.8 Critical (CVSS 3.1), and WPScan lists the same score. WPSec rates it 7.5 High because an admin has to run an export or restore. NVD hadn't added its own score yet.

Will Prime Mover 2.2.2 break my migrations?

Probably not. Codexonics says 2.2.2 only rebuilds stdClass objects during search-and-replace, so URLs stored inside custom serialized objects won't be updated. That's rare. If it happens to you, fix those URLs by hand with Better Search and Replace after the import.

• NVD, "CVE-2026-115806"
• CVE.org, "CVE-2026-115806"
• Wordfence Threat Intelligence, Prime Mover <= 2.2.1 advisory
• WordPress.org, "Prime Mover – Backup and Migration" changelog
• Codexonics, "Prime Mover 2.2.2 – User privacy feature and maintenance updates"
• WPScan, "Prime Mover – Backup and Migration" vulnerabilities
• WPSec, "WPSEC-2026-1305"
• OpenCVE, "CVE-2026-115806"