Prime Mover CVE-2026-115806

The storage half requires no special conditions: an unauthenticated attacker uses the default wp-comments-post.php comment endpoint, and the payload lands in wp_comments.comment_content regardless of comment moderation status. The trigger half is the key limiting factor: unserialize() only executes when an administrator subsequently runs a Prime Mover export or restore operation, so a site that never uses these migration features is not exercised. The gadget is self-contained - the plugin bundles the vulnerable Freemius library - so no additional plugin or theme is required. Applies to all versions up to and including 2.2.1; the unserialize() call has no allowed_classes restriction.

Multiple signals converge on genuine priority. CVSS 3.1 is 9.8 (AV:N/AC:L/PR:N/UI:N) and the vuln.today Decision label is act_now, both indicating a severe, remotely reachable flaw; Wordfence (the original reporter) classifies it as an unauthenticated PHP Object Injection with a self-contained POP chain, which is the highest-concern variant because no second plugin/theme is needed to weaponize it. The CWE-502 sink and the Freemius gadget chain are corroborated by direct source-code references on plugins.trac.wordpress.org, so the mechanism is well evidenced rather than merely asserted. One important nuance tempers the raw 9.8: the CVSS vector scores UI:N, but exploitation is a two-stage, deferred-trigger attack - the attacker stores the payload unauthenticated, yet unserialize() only fires when an administrator later runs a routine Prime Mover export or restore. That admin-side action is outside attacker control and is not reflected in the UI:N scoring, so real-world exploitation depends on a victim operating the backup feature. No EPSS score is provided, so widespread-exploitation probability cannot be quantified from this data, and the CVE is not listed in CISA KEV, so there is no confirmed active exploitation despite the critical score. Net: treat as high priority for any site running the plugin that uses its export/restore functions, while recognizing exploitation is contingent on the deferred admin trigger.

An unauthenticated attacker submits a comment through the standard wp-comments-post.php endpoint whose content is a base64-encoded serialized PHP object; the value is stored in wp_comments.comment_content even before moderation. Later, when a site administrator performs a normal Prime Mover export or restore, recursiveUnserializeReplace() base64-decodes the stored value and calls unserialize() with no allowed_classes restriction, instantiating the bundled Freemius FS_Clone_Manager POP chain (__set → set_option → store → update_option) to write arbitrary WordPress options, which can lead to full compromise. No public exploit code is identified in the provided data, though the vendor references pinpoint the exact sink and gadget lines.