WordPress security by component

Migrate WordPress Website & Backups

Plugin description

Migrate WordPress Website & Backups migrates WordPress websites, including their content, settings, and files.

Migrate WordPress Website & Backups (prime-mover) is a WordPress plugin with 4 published CVE records in this archive. The latest tracked vulnerability was published Oct 01, 2026; the highest published CVSS base score is 8.6.

Plugin slug: prime-mover

Latest vulnerability

CVE-2026-101890: Prime Mover: Stored XSS in package titles

The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped site_title value in a package's footprint.json file. Attackers can place a crafted package under the prime-mover-export-files directory so that the malicious value renders unescaped in the column_site_title() method of PrimeMoverBackupMenuListTable.php, triggering script execution in an administrator's browser when they view the Prime Mover Packages list table without needing to restore the package. The supplied CVSS vector requires low privileges, but the authoritative export does not identify a minimum WordPress role or how the attacker gains package-file placement. The authoritative export identifies the fixed release as 2.2.1.

PublishedOct 01, 2026

Known safe version2.2.1

Published vulnerabilities for prime-mover
		Safe version
Oct 01, 2026	CVE-2026-101890 Prime Mover: Stored XSS in package titles The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped site_title value in a package's footprint.json file. Attackers can place a crafted package under the prime-mover-export-files directory so that the malicious value renders unescaped in the column_site_title() method of PrimeMoverBackupMenuListTable.php, triggering script execution in an administrator's browser when they view the Prime Mover Packages list table without needing to restore the package. The supplied CVSS vector requires low privileges, but the authoritative export does not identify a minimum WordPress role or how the attacker gains package-file placement. The authoritative export identifies the fixed release as 2.2.1.	2.2.1	CVE5.1 NVDPending
Oct 01, 2026	CVE-2026-101889 Prime Mover: Path traversal and arbitrary directory deletion The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete arbitrary directories by importing a crafted WPRIME/TAR package with manipulated tar_root_folder values in wprime-config.json. Attackers can exploit insufficient path validation in computeExtractVariables() and validateImportedSiteVsPackage() to cause primeMoverDoDelete() to remove directories outside the intended extraction path, potentially deleting critical WordPress directories such as wp-admin and rendering the site inoperable. The disclosed attack requires an administrator account and a crafted migration package. The authoritative export identifies the fixed release as 2.2.1.	2.2.1	CVE7.0 NVDPending
Oct 01, 2026	CVE-2026-101888 Prime Mover: Zip Slip arbitrary file write The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php to write attacker-controlled content to arbitrary filesystem locations, potentially achieving remote code execution if the written files are interpreted by the web environment. Administrator access is required; code execution depends on writing a file that the server will interpret. The authoritative export identifies the fixed release as 2.2.1.	2.2.1	CVE8.6 NVDPending
Jan 08, 2024	CVE-2023-6505 Migrate WordPress Website & Backups: A security weakness Migrate WordPress Website & Backups is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE7.5 NVD7.5

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers