Migrate WordPress Website & Backups
Migrate WordPress Website & Backups migrates WordPress websites, including their content, settings, and files.
Migrate WordPress Website & Backups (prime-mover) is a WordPress plugin with 5 published CVE records in this archive. The latest tracked vulnerability was published Oct 24, 2026; the highest published CVSS base score is 9.8.
prime-moverCVE-2026-115806: Prime Mover: Object injection during administrator export or restore
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: at most 2.2.1. The narrative requires the later administrator or higher-privileged user action described above even though the vector records UI:N.
| Safe version |
|
||
|---|---|---|---|
| Oct 24, 2026 |
CVE-2026-115806
Prime Mover: Object injection during administrator export or restore
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: at most 2.2.1. The narrative requires the later administrator or higher-privileged user action described above even though the vector records UI:N.
|
2.2.2 |
CVE9.8
|
| Oct 01, 2026 |
CVE-2026-101890
Prime Mover: Stored XSS in package titles
The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped site_title value in a package's footprint.json file. Attackers can place a crafted package under the prime-mover-export-files directory so that the malicious value renders unescaped in the column_site_title() method of PrimeMoverBackupMenuListTable.php, triggering script execution in an administrator's browser when they view the Prime Mover Packages list table without needing to restore the package. The supplied CVSS vector requires low privileges, but the authoritative export does not identify a minimum WordPress role or how the attacker gains package-file placement. The authoritative export identifies the fixed release as 2.2.1.
|
2.2.1 |
CVE5.1
|
| Oct 01, 2026 |
CVE-2026-101889
Prime Mover: Path traversal and arbitrary directory deletion
The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete arbitrary directories by importing a crafted WPRIME/TAR package with manipulated tar_root_folder values in wprime-config.json. Attackers can exploit insufficient path validation in computeExtractVariables() and validateImportedSiteVsPackage() to cause primeMoverDoDelete() to remove directories outside the intended extraction path, potentially deleting critical WordPress directories such as wp-admin and rendering the site inoperable. The disclosed attack requires an administrator account and a crafted migration package. The authoritative export identifies the fixed release as 2.2.1.
|
2.2.1 |
CVE7.0
|
| Oct 01, 2026 |
CVE-2026-101888
Prime Mover: Zip Slip arbitrary file write
The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php to write attacker-controlled content to arbitrary filesystem locations, potentially achieving remote code execution if the written files are interpreted by the web environment. Administrator access is required; code execution depends on writing a file that the server will interpret. The authoritative export identifies the fixed release as 2.2.1.
|
2.2.1 |
CVE8.6
|
| Jan 08, 2024 |
CVE-2023-6505
Migrate WordPress Website & Backups: A security weakness
Migrate WordPress Website & Backups is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.5
|