Technical impact
The Prime Mover backup and migration plugin for WordPress contains an unauthenticated PHP object injection flaw that is triggered when a crafted, base64‑encoded serialized object is stored in a comment’s content field. When an administrator later runs an export or restore routine, the plugin decodes and unserializes that stored value without any class whitelisting. This allows an attacker to chain objects from the plugin’s bundled Freemius library, yielding a property‑oriented programming chain that can lead to arbitrary code execution. The attack requires only the ability to post a comment via the public comment‑submission endpoint; no additional plugin or theme is needed. Because this flaw is reachable from a remote client, it can be exploited to gain ultimate control over the site.
Affected Systems
WordPress installations that have the Prime Mover plugin at version 2.2.1 or earlier. The vulnerable component is the migration search‑and‑replace routine (recursiveUnserializeReplace). Any site running these editions, regardless of other plugins or themes, is affected.
Risk and Exploitability
The CVSS score of 9.8 indicates a critical severity. The EPSS score is not available, but the flaw’s remote, unauthenticated nature means a potential attacker does not need local access. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread public exploitation yet, but the high severity and lack of input filtering make it a high‑priority target for attackers. An attacker can simply submit a malicious comment; an administrator must then trigger an export or restore to activate the payload, giving the attacker full code execution on the site.
