Prime Mover backup plugin has a critical 9.8 vulnerability

Q: How can I tell whether someone has used the Prime Mover vulnerability?

Go through Comments in the All, Pending, Spam and Trash views for a comment whose text is a long run of Latin letters and digits that looks like nothing a person would write, and delete it permanently. If you ran an export or restore with version 2.2.1 or older and find such a comment, check in Settings > General whether "Anyone can register" is ticked and which role new users get by default. Then look under Users for administrators you do not recognise, because such an administrator or a changed setting means the site is hacked.

# TagsSecurityBackupsWordPress

The WPhost team27 Oct 20269 min read

On 24 October 2026 NVD published a record for a critical vulnerability in Prime Mover, the backup and migration plugin for WordPress sites (CVE-2026-115806). Every version up to and including 2.2.1 is affected. Wordfence, which issued the record, scores it 9.8 out of 10 on the CVSS scale. The attack needs no account on the site. According to wordpress.org the plugin has more than 10,000 active installations.

The fix is in version 2.2.2, released on 19 October, five days before the record went public. If automatic plugin updates are switched on, your site may already have it. If they are not, update before your next Prime Mover export or restore, because that is exactly when the attack goes off.

Why a flaw in a backup plugin is so serious

A backup and migration plugin handles the whole site at once. It reads every table in the database, packs the files into an archive and, on a restore, writes everything back. To do that it runs with administrator rights. So a bug in such a plugin reaches everything the site holds.

On a WooCommerce store the database holds the orders, the customers' names and phone numbers, the delivery addresses for Econt or Speedy and often the invoice details. All of it passes through the plugin on every export, and the finished archive stays on the server until someone deletes it.

How the attack works through comments

During an export or a restore, Prime Mover runs a search-and-replace over the database, which is how it swaps the site's address when a site moves, for example. Some WordPress data is stored in serialised form, as text that PHP turns back into arrays and objects. The plugin unpacks such text, makes its replacements inside it and packs it again. If the value is Base64-encoded, it decodes it first.

According to the record, the attacker submits a comment through the ordinary comment form (wp-comments-post.php) whose text is exactly such an encoded object. No account is needed for that. The comment sits in the database until an administrator runs a Prime Mover export or restore. The plugin then decodes the text and builds an object from it without restricting which classes it may come from. This is called PHP Object Injection.

An object on its own is not yet a breach. The attacker also needs what is called a POP chain, a sequence of existing code that the object sets off. The record says such a chain exists inside Prime Mover itself, in the Freemius library the plugin ships for its licensing and updates. No other plugin or theme is required. The chain ends in update_option(), the function WordPress uses to save its settings, and the code of version 2.2.1 shows that the name of the setting comes from the attacker's object. In other words, the attacker picks which site setting to overwrite.

The record sets no condition that the comment be approved, and WordPress stores comments awaiting moderation and comments marked as spam in the database as well. WooCommerce product reviews go through the same comment form, so a store without a blog can be exposed too.

In version 2.2.2 the plugin builds only plain objects of PHP's built-in stdClass from such text and rejects everything else, which breaks the chain. As of 27 October, neither NVD nor the CVE.org record reports attacks using this vulnerability. The record does point to the exact lines of code, though, which makes life easier for anyone who wants to use it. The CVSS score guide explains what a 9.8 means.

Is your site affected?

It is if Prime Mover is installed and its version is 2.2.1 or older. You can see the version under Plugins > Installed Plugins. In cPanel's Terminal, the command below shows the same without changing anything. The WP-CLI guide explains how to work with WP-CLI.

Bash

# cPanel > Terminal, in the site's folder
# Read-only. Shows the Prime Mover plugins and their versions.
wp plugin list --fields=name,title,status,version \
  --skip-plugins --skip-themes | grep -i prime

While the plugin is deactivated, the attack cannot fire. A malicious comment stays in the database, though, waiting for the plugin to be switched back on, so update or delete Prime Mover even if it is deactivated.

The record names the free plugin from wordpress.org. The paid version installs as a separate plugin (WP-CLI calls it prime-mover-pro), and the command above lists it too. If you use it, update it to the latest version as well and check with the developer, Codexonics, that it includes the fix from 2.2.2.

What to do

Update Prime Mover to 2.2.2 or later from Plugins > Installed Plugins or from WP Toolkit in cPanel. Then check the version once more.
If you want a backup before updating, take it with your hosting's backup tool or as described in the backup guide. Do not take it with Prime Mover, because an export with the old version is exactly the moment the attack goes off.
If you cannot update right away, deactivate the plugin until you can and run no exports or restores with it.
Go through Comments in the All, Pending, Spam and Trash views. Look for a comment whose text is a long run of Latin letters and digits that looks like nothing a person would write. Delete any such comment permanently. Finding nothing does not prove there was no attempt.
If you ran an export or a restore with version 2.2.1 or older and you find such a comment, assume the site's settings may have been changed. Open Settings > General and see whether "Anyone can register" is ticked and which role is set as the "New User Default Role". Then check Users for administrators you do not recognise.

What we do

With vulnerability (CVE) monitoring we track what is installed on your site and match it against the vulnerability (CVE) databases every day. As soon as a vulnerability appears in something you use, we send you an alert and update, trying the update on a copy in staging first. Your site can be hosted anywhere. If you would like us to add it, write to us through the inquiry form.

Frequently asked questions

What is CVE-2026-115806 in Prime Mover?

A critical vulnerability in Prime Mover, the backup and migration plugin for WordPress sites, published in the NVD on 24 October 2026. Every version up to and including 2.2.1 is affected, the attack needs no account on the site, and Wordfence scores it 9.8 out of 10 on CVSS. It is a PHP Object Injection flaw.

Which version of Prime Mover fixes the vulnerability?

Prime Mover 2.2.2, released on 19 October 2026, five days before the record went public. If automatic plugin updates are on, your site may already have it. Check the version under Plugins > Installed Plugins.

How does the attack on Prime Mover work through comments?

The attacker submits a comment through the ordinary comment form whose text is an encoded PHP object, and needs no account to do so. The comment waits in the database until an administrator runs a Prime Mover export or restore. The plugin then decodes the text and builds an object from it, and through code in the Freemius library that ships with the plugin the attacker overwrites a site setting of their choosing.

Is a store without a blog affected if comments are switched off?

It can be. WooCommerce product reviews go through the same comment form, so a store without a blog is exposed too. The record sets no condition that the comment be approved, and WordPress keeps comments awaiting moderation and those marked as spam in the database as well.

Is Prime Mover dangerous if the plugin is deactivated?

While Prime Mover is deactivated, the attack cannot fire. A malicious comment stays in the database, though, waiting for the plugin to be switched back on. So update or delete Prime Mover even if it is deactivated.

Is the paid Prime Mover PRO affected?

The record names the free plugin from wordpress.org. The paid version installs as a separate plugin, which WP-CLI calls prime-mover-pro. If you use it, update it to the latest version too and check with the developer, Codexonics, that it includes the fix from 2.2.2.

Can I take a backup with Prime Mover before updating?

Do not. An export with the old version of Prime Mover is exactly the moment the attack goes off. If you want a backup before updating, take it with your hosting's backup tool.

How can I tell whether someone has used the Prime Mover vulnerability?

Go through Comments in the All, Pending, Spam and Trash views for a comment whose text is a long run of Latin letters and digits that looks like nothing a person would write, and delete it permanently. If you ran an export or restore with version 2.2.1 or older and find such a comment, check in Settings > General whether "Anyone can register" is ticked and which role new users get by default. Then look under Users for administrators you do not recognise, because such an administrator or a changed setting means the site is hacked.

Sources