Security notice

Prime Mover backup plugin on your WordPress site? A 9.8-rated flaw starts with a stranger's comment. Update today.

What happened

• A two-step flaw. Wordfence, which assigned the CVE number, says the free Prime Mover - Backup and Migration plugin, versions up to and including 2.2.1, reads data unsafely during its migration search-and-replace step. It says an unauthenticated visitor can store a specially built, encoded object in a comment through the normal comment form, with no account, and that when an administrator later runs a Prime Mover export or restore, the plugin decodes that comment and loads it without limiting what it may contain. (CVE record, Rapid7)
• The plugin carries its own tool for the attack. Wordfence says a chain of code in the plugin's own bundled Freemius library lets the stored object take effect, so no other plugin or theme is needed. RescuePHP says the effect is that the object can overwrite WordPress settings. AlCybr and ServerGurus both note that Wordfence's description does not claim attackers can run commands on the server. (CVE record, RescuePHP, AlCybr, ServerGurus)
• The 9.8 score, and what it leaves out. Wordfence scores it 9.8 out of 10 and rates confidentiality, integrity and availability impact all High. The score's vector says no user action is needed, but Wordfence's own description says the attack waits for an administrator to run an export or restore. ServerGurus reported on October 25 that NVD, the US government's vulnerability database, had not yet added a score of its own, so the 9.8 is Wordfence's. (CVE record, Rapid7, ServerGurus)
• The fix: version 2.2.2. The plugin's changelog on WordPress.org lists 2.2.2 with "Hardened unserialize implementation to prevent object injection," crediting the researcher Civitasmass of Wordfence, and the developer, Codexonics, says it now allows only plain generic objects. Patchstack also lists 2.2.2 as the patched version. WordPress.org shows 2.2.2 as the current version, updated October 19, with 10,000+ active installs. (plugin changelog, Codexonics, Patchstack)
• One side effect. Codexonics says that after 2.2.2, a search-and-replace during a move will skip web addresses or file paths stored inside unusual custom objects, and that you can fix those by hand afterward with a search-and-replace tool. It calls this very unlikely to matter. (Codexonics)
• A conflict between sources, stated plainly. ServerGurus, in a post dated October 25, says Wordfence's entry, last updated October 24, still read "No known patch available," and AlCybr reported on October 27 that Wordfence's advisory still labels the flaw unpatched. We could not open Wordfence's page ourselves, because it blocked our request. Against that, the plugin's own changelog and Patchstack both name 2.2.2 as the fix, and the CVE record lists only versions up to 2.2.1 as affected. We have not tested 2.2.2 ourselves. Our advice is to update to 2.2.2 now and not wait for Wordfence's label to change. (AlCybr, ServerGurus, plugin changelog, Patchstack, CVE record)
• No attacks reported, not on CISA's list. RescuePHP said no attacks in the wild and no public exploit had been reported as of October 24, and ServerGurus cites Dr.Web saying attacks were not known as of that date. Rapid7 shows the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and we found it absent from the latest version of that catalog, dated October 27, which we checked on October 28. Patchstack rates it high priority and says flaws like this are used in mass campaigns that attack thousands of sites. (RescuePHP, ServerGurus, Rapid7, Patchstack)

Who should worry

• Your WordPress site has the Prime Mover - Backup and Migration plugin installed, on version 2.2.1 or older, active or not.
• Your developer, agency or host uses Prime Mover to copy, back up or move your site, especially to a staging copy or a new server.
• Your site lets visitors leave comments. RescuePHP says comment moderation does not stop the data being stored, because held comments are still written to the database, and closing comments later does not remove ones already stored. (RescuePHP)
• You are not sure which plugins your site uses. Ask.

The attack needs an administrator to run an export or restore after the stranger's comment has been stored. That is a routine job for sites that move or back up often, so it is a matter of when. (CVE record, RescuePHP)

What to do now

Do these today.

1. Ask the question. Send the message below to your developer, agency or host. You need a clear answer: is Prime Mover installed on any of our sites, and which version?
2. Update Prime Mover to 2.2.2 or later, before any export, backup or restore. In WordPress, open Plugins, find Prime Mover - Backup and Migration, and update it. Do not run a Prime Mover export or restore on 2.2.1 or older, even to be safe. (plugin changelog, ServerGurus)
3. If you cannot update today, deactivate the plugin. RescuePHP says this removes the vulnerable code, but it does not remove anything already stored in comments. It also suggests turning off public comments for now. (RescuePHP)
4. Check your comments for strange data. Ask your developer to look in the comments table of the database, including held, spam and trash comments, for long, unbroken blocks of text with no spaces that decode to PHP serialized data. RescuePHP advises searching for suspicious encoded, serialized strings before any export or restore. A simple first search is below. A match is a lead to look at, not proof of an attack, and no match does not prove your site is clean. Delete anything suspicious before the next export. (RescuePHP)

   SELECT comment_ID, comment_date, comment_approved, LENGTH(comment_content)
   FROM wp_comments
   WHERE LENGTH(comment_content) > 200 AND comment_content NOT LIKE '% %'
   ORDER BY comment_date DESC;

   If your tables use a different prefix, change wp_.
5. If someone ran an export or restore on 2.2.1 or older, look for changes. RescuePHP advises reviewing recently changed rows in the site's options table after updating, and ServerGurus adds checking the list of administrators for accounts you do not recognize. We have not seen a report that any site was changed. This is a precaution. (RescuePHP, ServerGurus)
6. Keep it updated. Turn on automatic updates for the plugin if your developer agrees. If a security tool still says Prime Mover is unpatched after 2.2.2, see the conflict between sources above, and ask your developer to confirm the version.

What to send your developer, agency or host

Wordfence published CVE-2026-115806 on October 24, 2026, a flaw rated 9.8 in the WordPress plugin Prime Mover - Backup and Migration, versions up to 2.2.1. It says a visitor can store a specially built comment, and that it is read unsafely when an administrator later runs a Prime Mover export or restore. The fix is version 2.2.2. Please tell me today: is Prime Mover installed on any of our sites, and which version? If it is 2.2.1 or older, please update it to 2.2.2 or later before anyone runs an export, backup or restore, or deactivate it until then. Please also search the comments table, including spam, held and trash comments, for long unbroken strings with no spaces that decode to serialized PHP data, delete any you find, and tell me what you find. Sources: CVE record, plugin changelog, RescuePHP.

Common questions

Sources

• CVE Program: CVE-2026-115806 record, assigned by Wordfence, published October 24, 2026, checked October 28, 2026
• Wordfence: Prime Mover - Backup and Migration vulnerability entry, the CVE assigner. We could not open this page on October 28, 2026 because it blocked our request, so we relied on the reports of it cited above
• WordPress.org: Prime Mover - Backup and Migration, changelog and plugin details, version 2.2.2, checked October 28, 2026
• Codexonics: Prime Mover 2.2.2 release notes, October 19, 2026
• Patchstack: Prime Mover 2.2.1 and earlier: unauthenticated PHP object injection, October 26, 2026
• Rapid7: CVE-2026-115806 vulnerability database entry, checked October 28, 2026
• RescuePHP: Prime Mover CVE-2026-115806: a WordPress comment can plant a PHP object injection that fires on export, October 2026
• AlCybr: Prime Mover fixes PHP object-injection flaw in version 2.2.2, October 27, 2026
• ServerGurus: CVE-2026-115806: Prime Mover 2.2.1 Unserializes a Comment, October 25, 2026
• CISA: Known Exploited Vulnerabilities Catalog, catalog version dated October 27, 2026, checked October 28, 2026