Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-115806

Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Codexonics Wordpress-extensions
Products
Prime Mover – Backup And Migration Prime Mover
CVE-2026-101888

Prime Mover < 2.2.1 Zip Slip Path Traversal File Write

The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php to write attacker-controlled content to arbitrary filesystem locations, potentially achieving remote code execution if the written files are interpreted by the web environment.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Codexonics Wordpress-extensions
Products
Prime Mover Prime Mover
CVE-2026-101889

Prime Mover < 2.2.1 Path Traversal via wprime-config.json

The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete arbitrary directories by importing a crafted WPRIME/TAR package with manipulated tar_root_folder values in wprime-config.json. Attackers can exploit insufficient path validation in computeExtractVariables() and validateImportedSiteVsPackage() to cause primeMoverDoDelete() to remove directories outside the intended extraction path, potentially deleting critical WordPress directories such as wp-admin and rendering the site inoperable.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Codexonics Wordpress-extensions
Products
Prime Mover Prime Mover
CVE-2026-101890

Prime Mover < 2.2.1 Stored XSS via Package Metadata

The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped site_title value in a package's footprint.json file. Attackers can place a crafted package under the prime-mover-export-files directory so that the malicious value renders unescaped in the column_site_title() method of PrimeMoverBackupMenuListTable.php, triggering script execution in an administrator's browser when they view the Prime Mover Packages list table without needing to restore the package.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Codexonics Wordpress-extensions
Products
Prime Mover Prime Mover
CVE-2023-6505

Prime Mover < 1.9.3 - Directory Listing to Sensitive Data Exposure

The Migrate WordPress Website & Backups WordPress plugin before 1.9.3 does not prevent directory listing in sensitive directories containing export files.

CVSS 3.1 · 7.5 High EPSS 39.9% KEV · Not listed
Vendors
Codexonics
Products
Prime Mover