CVE-2026-115806

Name of the Vulnerable Software and Affected Versions Prime Mover versions prior to 2.2.2

Description An unauthenticated attacker can perform PHP Object Injection by submitting a crafted, base64-encoded serialized object through the standard comment-submission endpoint 'wp-comments-post.php', which is stored in wp comments.comment content. The issue occurs during a migration search-and-replace routine in the recursiveUnserializeReplace() function when an administrator performs an export or restore operation. The plugin decodes the stored value and passes it to unserialize() without restricting allowed classes. This allows the use of a Property-Oriented Programming (POP) chain—a technique that leverages existing code fragments (gadgets) to execute unintended logic—found within the bundled Freemius library via the sequence FS Clone Manager:: set to FS Option Manager::set option to store() to update option(). This can lead to arbitrary option writes and remote code execution.

Recommendations Update Prime Mover to version 2.2.2 or later.