CVE-2026-115806: Prime Mover 2.2.1 Unserializes a Comment - Floor 2.2.2

CVE-2026-115806 is Wordfence’s name for unauthenticated PHP object injection in Prime Mover - Backup and Migration (prime-mover) through 2.2.1. They score it 9.8 critical (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CWE-502: Deserialization of Untrusted Data. CVE state PUBLISHED 24 October 2026 (datePublished 2026-10-24T04:32:10.565Z). Wordfence intel: publicly published 22 October 2026, last updated 24 October 2026. Finder: Civitasmass. CNA timeline: vendor notified 11 October 2026, disclosed 22 October 2026.[1][2][3]

The wordpress.org plugin API this morning returned version 2.2.2, active_installs 10000 (the directory’s 10k bucket), last updated 2026-10-19 12:40am GMT, tested to 7.1.3, requires WP 5.2 / PHP 5.6. Author profile: codexonics. Homepage: https://codexonics.com/.[6]

What it is

This is CWE-502 in the Prime Mover plugin on wordpress.org, not a WordPress core bug and not PHP2Shell.[1][2]

Wordfence’s CNA text: an unauthenticated attacker can store a base64-encoded serialized object in wp_comments.comment_content via the normal comment form (wp-comments-post.php). When an administrator later runs a Prime Mover export or restore, the migration search-and-replace routine recursiveUnserializeReplace() base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction on 2.2.1. They say a POP chain is in the plugin’s own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no extra plugin or theme is required.[1][2][3]

We did not post a comment, run an export, or instantiate Freemius objects. Treat the comment → export/restore → unserialize path and the Freemius gadget names as Wordfence’s published claim, not as a request we sent.[1][3]

Vendor changelog does print a matching security bullet, without the CVE ID:

2.2.2 (19 Oct on wordpress.org): “Hardened unserialize implementation to prevent object injection. (Credit: Civitasmass/Wordfence)”; also “Updated Freemius SDK to the latest version.”[4][6]

On the 2.2.1 tag, utilities/PrimeMoverSearchReplace.php line 1281 is @unserialize($data). On the 2.2.2 tag that line is PrimeMoverBridgeIO::unserialize($data). The wrapper in global/PrimeMoverBridgeIO.php on 2.2.2, for PHP ≥ 7.0, calls unserialize(..., ['allowed_classes' => ['stdClass']]). PHP 5.6 (still in requires_php) takes a different branch that rejects serialized strings matching O: / C: class objects via a regex, then calls unserialize without the options array.[7][8]

That is a call-site change we read, not a proof that every gadget is dead. Wordfence’s intel page, last updated 24 October 2026, still printed Patched? No / “No known patch available.” We are flooring at 2.2.2 because that is the current wordpress.org release and the changelog credits this finder for an unserialize harden - not because Wordfence flipped the patched bit.[3][4][6]

How serious

A 9.8 with C:H I:H A:H and PR:N is “unauthenticated, total impact on the scored component.” Wordfence’s write-up is object injection that can write WordPress options via the bundled Freemius gadget, not a claimed eval as root and not PHP2Shell.[1][2][3]

The CVSS UI:N does not match the prose: the CNA says the object is instantiated when an administrator later migrates or restores. WPSec’s parallel advisory (WPSEC-2026-1305, published 21 October 2026, later mapped to this CVE) scored it AV:N/AC:H/PR:N/UI:R and C:H I:H A:H - same impact, but they treat the admin export/restore as required interaction and they said no known POP chain in the plugin itself (Wordfence later named Freemius). Both records exist; we are not collapsing them.[3][9]

This CVE is not in CISA KEV as of catalog 2026.10.23 (dateReleased 2026-10-23T19:30:18.9209Z, 1756 entries). Newest dateAdded on that dump: 23 Oct Collabora CODE / Arista VeloCloud - not WordPress. Absence from KEV is not a clean bill of health.[5]

NVD vulnStatus is Received (timestamp on the object we pulled: 2026-10-25T03:30:56.587Z). No NVD-assigned 3.1 of its own; the 9.8 is Wordfence, type Primary on that record. No CISA SSVC row on the object we fetched.[2]

Dr. Web, citing Wordfence/NVD on 24 October 2026, wrote that attacks were not known as of that date. We did not independently hunt.[10]

Who is affected

In scope, per the CNA / NVD affected block:[1][2]

Any site with prime-mover ≤ 2.2.1 installed. The plant path they published is the public comment form.
Abandoned copies on 2.1.x / 2.0.x / 1.9.x - wordpress.org active versions this morning: 2.2 50.8%, 2.1 26.5%, 2.0 13.2%, 1.9 6.6%, other 3.0%. The 2.2 bucket includes both 2.2.1 (affected) and 2.2.2 (current); we cannot split it from that table.[11]
Agencies that clone client sites with Prime Mover on a schedule. The CNA trigger is export or restore, not “only production.”

Out of scope unless you have a separate advisory:

The free plugin already on 2.2.2 (API version this morning is 2.2.2).[6]
WordPress core.
Duplicator / UpdraftPlus / All-in-One WP Migration. Different slugs. Wordfence’s Duplicator unauth object-injection row is an old <= 1.5.17 record, not this ID; current Duplicator on wordpress.org this morning is 5.0.6 / 1M-install bucket.[12]
Prime Mover PRO-only features. This CVE’s affected product string is the wordpress.org plugin Prime Mover - Backup and Migration.[1]

Comments closed, heavily moderated, or behind a login narrow the plant path. They do not change the CNA version range. Pending comments still live in wp_comments; Wordfence’s plant is the comment content, not “approved only.”[1][3]

What to do now

Inventory the slug, not a migration screenshot.

# one site
wp plugin get prime-mover --field=version --path=/home/USER/public_html
wp plugin list --name=prime-mover --fields=name,status,version --path=/home/USER/public_html

# cPanel box, every account (read-only)
find /home -path '*/wp-content/plugins/prime-mover/prime-mover.php' 2>/dev/null \
  | while read -r f; do
      ver=$(awk -F': ' '/^[[:space:]]*\*?[[:space:]]*Version:/{print $2; exit}' "$f")
      echo "$ver  $f"
    done

Ship 2.2.2 before the next export. That is what wordpress.org is serving. Do not run a Prime Mover backup/restore/migrate on 2.2.1 “just to be safe.”[4][6]

wp plugin update prime-mover --path=/home/USER/public_html
wp plugin get prime-mover --field=version --path=/home/USER/public_html   # want 2.2.2

If you cannot update today: deactivate, and do not export. A WAF rule is not a version bump. Closing comments reduces the plant path; it does not remove objects already sitting in wp_comments.[1][3]

wp plugin deactivate prime-mover --path=/home/USER/public_html

Before the next migration on a box that was ≤ 2.2.1: purge obvious junk comments (spam / pending / trash) in wp-admin, then update, then export. We are not publishing a SQL fingerprint for the payload. Presence of a long base64 blob in comment_content is a hunt target, not proof of this CVE.
Do not treat the patch as forensic cleanup. 2.2.2 stops this unserialize call site from loading arbitrary classes (on the PHP ≥ 7 wrapper we read). It does not unwind an option that Freemius update_option() already wrote, and it does not uninstall a user that landed afterwards. If you have reason to hunt, dump wp_users / wp_usermeta for unexpected administrators, review wp_options autoloaded rows you did not set, rotate WordPress salts, and invalidate sessions - then keep hunting. We are not claiming you were hit.[7][8]
Unsupported / frozen lines. CNA defaultStatus is unaffected except the <= 2.2.1 range. There is no 2.1.x patched build in the record we pulled. Jump a frozen 2.1 site through staging, or remove the plugin.[1][2]

Compromise signs

The published class is object injection → option write (C/I/A high). Hunt for, do not treat as proof:[1][2][3]

New WordPress administrators you did not create, especially right after a Prime Mover export/restore in the audit log / wp_users.user_registered.
wp_options rows you did not set, including Freemius-looking option names, coinciding with a migration job.
Comment spam in hold/spam/trash around 11-24 Oct that is a dense base64 blob rather than a sentence. That pattern is not unique to this CVE.
Sites that restored a Prime Mover package from an unpatched origin onto a patched target - the plant lives in the database dump, not only on the running plugin.

Presence of a new admin is a hunt target for any WP incident, not a fingerprint unique to this CVE. Absence is not proof of cleanliness. We did not publish a Nuclei template and we did not send a probe.

FAQ

Is this PHP2Shell? No. PHP2Shell is CVE-2026-109618 / 109619 in PHP itself. This ID is a plugin unserialize bug.[1]

Wordfence still says unpatched. Is 2.2.2 enough? Wordfence intel Patched? was No as of 24 October 2026. Vendor 2.2.2 changelog credits Civitasmass/Wordfence for the unserialize harden, and the 2.2.2 tag no longer calls raw @unserialize at that line. Inventory to 2.2.2. If Wordfence later publishes a different floor, follow the later CNA update.[3][4][7][8]

Does an attacker need me to click something? Wordfence’s vector is UI:N. Their prose still requires an administrator export or restore to instantiate the object. WPSec scored UI:R. Plan as: plant is unauthenticated; detonation waits on your migration job.[1][3][9]

Does this give root on the box? The scored scope is unchanged. This is the WordPress / plugin option boundary, not a claimed KVM or panel root. A written wp_options row plus a new admin is still a site-takeover.[1][2]

Are comments-closed sites safe? Safer on the plant path. Not out of the CNA version range. Pending comments from before you closed the form still sit in the table the search-replace walks.[1]

Honesty / What we could not verify

We did not exploit this. No comment was posted. No export was run. No Freemius object was constructed.
We did not map a full POP chain. Gadget names are Wordfence’s. We confirmed the 2.2.1 @unserialize call and the 2.2.2 wrapper; we did not execute __set.
Wordfence patched bit ≠ vendor changelog. Intel still said no patch on 24 Oct; 2.2.2 shipped 19 Oct with the finder credited. We are not waiting for that checkbox.[3][4]
10,000 is wordpress.org active_installs this morning, not a census we ran. The 50.8% on the 2.2 branch mixes patched and unpatched.[6][11]
Not on CISA KEV as of catalog 2026.10.23 / count 1756.[5]
NVD status Received; 9.8 is Wordfence Primary, not an NVD-assigned metric. No SSVC row on the object we fetched.[2]
In-the-wild: Dr. Web said none known as of 24 Oct. We did not scan the fleet for this payload.[10]

Sources

[1] https://cveawg.mitre.org/api/cve/CVE-2026-115806 [2] https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-115806 [3] https://www.wordfence.com/threat-intel/vulnerabilities/id/ab6ebd66-c7a4-402e-b51e-3f1f3183bd97?source=cve [4] https://plugins.svn.wordpress.org/prime-mover/tags/2.2.2/readme.txt [5] https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json [6] https://api.wordpress.org/plugins/info/1.2/?action=plugin_information&request%5Bslug%5D=prime-mover [7] https://plugins.svn.wordpress.org/prime-mover/tags/2.2.1/utilities/PrimeMoverSearchReplace.php [8] https://plugins.svn.wordpress.org/prime-mover/tags/2.2.2/global/PrimeMoverBridgeIO.php [9] https://wpsec.com/vuln/WPSEC-2026-1305/ [10] https://www.drweb.de/prime-mover-sicherheitsluecke-backup/ [11] https://wordpress.org/plugins/prime-mover/advanced/ [12] https://api.wordpress.org/plugins/info/1.2/?action=plugin_information&request%5Bslug%5D=duplicator