Prime Mover CVE-2026-101889

Requires an authenticated WordPress administrator account (CVSS PR:H) who imports a crafted WPRIME/TAR package containing a wprime-config.json with manipulated tar_root_folder values; the Prime Mover plugin (before 2.2.1) must be installed and the import feature used. Exploitation is limited by the need for administrator-level privileges - this cannot be triggered by unauthenticated or low-privileged users - and by requiring the victim to perform (or be tricked into performing) the malicious package import. No user interaction beyond the admin's own import action is needed (UI:N). Default configurations are affected once the plugin is present and an admin imports a package.

This is a moderate, not top-tier, priority. The CVSS 4.0 base score of 7.0 is driven by integrity and availability impact (VI:H/VA:H) with no confidentiality loss (VC:N), and critically requires high privileges (PR:H) - only an authenticated WordPress administrator can trigger it by importing a crafted WPRIME/TAR package. The attack vector is network (AV:N) and complexity is low (AC:L, AT:N) once admin access is held, but PR:H is the dominant mitigating factor: an administrator already has legitimate power to damage a site, so this vulnerability primarily matters for compromised/abused admin accounts or multi-admin environments where a lower-trust admin should not be able to destroy the filesystem. No EPSS score, KEV listing, or POC was provided in the input, and there is no public exploit identified at time of analysis, indicating no evidence of widespread or active exploitation. The signals are internally consistent - there is no CVSS-vs-description conflict here; the description's 'authenticated administrators' aligns with PR:H. Net: a real, patch-worthy integrity/availability bug, but the admin-privilege precondition keeps real-world risk well below that of an unauthenticated RCE.

An attacker who has obtained WordPress administrator access (e.g., via phishing, credential reuse, or a lower-trust admin on a shared multi-admin site) crafts a malicious WPRIME/TAR backup package whose wprime-config.json contains manipulated tar_root_folder values. Upon importing it through Prime Mover, insufficient path validation in computeExtractVariables() and validateImportedSiteVsPackage() causes primeMoverDoDelete() to remove directories outside the extraction path - such as wp-admin - rendering the site inoperable. No public exploit code was identified at time of analysis.