Critical PHP Object Injection Vulnerability in Prime Mover – Backup and Migration WordPress Plugin
A critical vulnerability, CVE-2026-115806, with a CVSS score of 9.8, was discovered in the Prime Mover – Backup and Migration WordPress plugin. This vulnerability allows unauthenticated attackers to inject malicious PHP objects, potentially leading to remote code execution, due to the deserialization of untrusted input in the plugin's migration search-and-replace routine. The vulnerability affects all versions up to and including 2.2.1 and has a Property-Oriented Programming (POP) chain present in the plugin's bundled Freemius library, making exploitation more feasible. Immediate patching or mitigation is strongly recommended.