CVE-2026-115806
CriticalCVSS 9.8Summary
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine. An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint. When an administrator performs a routine export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library, so no additional plugin or theme is required.
Risk Assessment
This could lead to remote code execution or other severe impacts, as the attacker can leverage the POP chain to invoke dangerous functions. The risk is high because the attack requires no authentication and only requires an administrator to perform a routine export or restore operation.
Recommendation
Update the Prime Mover plugin to a version later than 2.2.1 if available. Until then, consider disabling the plugin or restricting comment submission by unauthenticated users.
Related vulnerabilities
- CVE-2026-115931Critical
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels, but the backend did not restrict which functions could be requested, allowing calls to internal helpers. One helper reads a file from the server's disk (e.g., environment file with the session signing secret, database address, and service credentials), and another makes the backend process exit with a single request. Self-registration is open by default, so no existing account or action by another user is needed.
- CVE-2026-115893Critical
Wasmtime prior to 36.0.19, 48.0.7, and 49.0.4 has a flaw in the Cranelift compiler on aarch64. A br_table instruction with more than ~256,000 targets can be miscompiled, allowing a jump to arbitrary code and sandbox escape.
- CVE-2026-115889Critical
Wasmtime prior to 36.0.19 and 43.0.0 has a flaw in the Cranelift compiler where SSA value indices can silently overflow when compiling large Wasm functions. This can cause miscompilation, type confusion, and sandbox escape.
- CVE-2026-115812Critical
A relative path traversal during model archive extraction in AWS Multi Model Server 1.1.11 and earlier allows remote actors to execute arbitrary code via a crafted model archive. The project is end of life and no fixed version is available.
- CVE-2026-55486Critical
In Goobi viewer from version 25.08 to before 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token accept an origin query parameter without validation and embed it into the Content-Security-Policy header and an HTML response body as a postMessage argument. Since the attacker controls both calls, the unescaped value yields reflected XSS.
- CVE-2026-53942Critical
In conda/conda prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability remains in .github/workflows/update.yml. It is triggered by comments containing @conda-bot render or @conda-bot recreate, allowing an untrusted PR to reach Jinja2 template rendering in a privileged token context.
- CVE-2026-46652Critical
In Goobi viewer from version 24.03 to before 26.05, ExternalFilesDownloader.getFilename() extracts the filename from a server-supplied Content-Disposition header and passes it directly to Path.resolve() without stripping directory components. A malicious HTTP server can supply an absolute path or ../ sequences, writing attacker-controlled content to an arbitrary path, leading to remote code execution.
- CVE-2026-46651Critical
In Goobi viewer from version 24.03 to before 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.
- CVE-2026-53921Critical
In odhcpd (the DHCPv6/DHCPv4/RA server used by OpenWrt) prior to version 25.12, the DHCPv6 IA response handler writes past a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable over the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt, and embedded targets often lack stack canaries and ASLR, making code execution realistic.
- CVE-2026-114357Critical
In DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9, the Android Debug Bridge daemon (adbd) lacks authentication for a critical function. The device ships with ro.adb.secure=0 and USB ADB enabled by default; once ADB over TCP is enabled, the same unauthenticated shell (uid 2000) is reachable over the network. This provides a foothold for privilege escalation to root.
Original NVD description (English source)
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS