1 vulnerability across 1 product scored HIGH or above on October 24, 2026.

  • 🟠 HIGH: 1

🟠 [HIGH] codexonics/prime_mover_–_backup_and_migration

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:codexonics:prime_mover_backup_and_migration:*:*:*:*:*:*:*:* (< 2.2.2)

Codexonics Prime Mover – Backup and Migration Plugin — Critical WordPress Vulnerability

One critical vulnerability (CVE-2026-115806, CVSS 9.8) affects the Prime Mover – Backup and Migration plugin for WordPress in all versions through 2.2.1. An unauthenticated attacker can achieve PHP Object Injection by submitting a crafted, base64-encoded serialized payload through the standard WordPress comment submission endpoint. When an administrator later runs a backup or migration operation, the plugin’s search-and-replace routine deserializes the malicious object, potentially leading to remote code execution. This vulnerability is considered exploitable and requires no authentication, making it particularly dangerous.

WordPress administrators running any version of Prime Mover up to and including 2.2.1 should update immediately to a patched release. If no patch is yet available, consider temporarily deactivating the plugin and reviewing recent comment submissions for suspicious base64-encoded content. Security teams should consult the vendor advisory at the WordPress plugin repository for further technical details and remediation guidance.

Vendor Advisory