CVE-2026-115806

Summary

The Prime Mover plugin for WordPress is vulnerable to PHP Object Injection via untrusted input in its migration search-and-replace routine, allowing an unauthenticated attacker to inject a malicious serialized object through comment submission, which executes during admin-initiated export or restore operations.

Exploitability

Exploitation is straightforward for an unauthenticated attacker since it only requires submitting a specially crafted comment via the standard WordPress comment endpoint without authentication or user interaction.

Blast radius

Successful exploitation grants full remote code execution as the web server user, compromising confidentiality, integrity, and availability of the entire WordPress site and potentially the underlying server.

Detection

Defenders should monitor wp-comments-post.php POST requests for unusually long or base64-encoded comment_content values that decode to serialized PHP objects (e.g., strings starting with 'O:'); such objects may indicate attempted exploitation.

Prioritized remediation

Upgrade to Prime Mover version 2.2.2 or later, which fixes the vulnerability by adding an allowed_classes restriction to the unserialize() call in recursiveUnserializeReplace().

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.