Prime Mover EUVD-2026-90911

Requires an authenticated WordPress administrator account (CVSS PR:H) and use of the Prime Mover plugin's migration ZIP import feature: the attacker must be able to supply a migration package whose ZIP entry names include directory-traversal sequences processed by computeExtractionParameters() and resumableZipExtractor(). Exploitation is limited to deployments running Prime Mover before 2.2.1, and achieving full remote code execution additionally depends on writing to a filesystem location that the web server will interpret (e.g., a PHP-executable path), which is not guaranteed in all hosting configurations. The admin-privilege prerequisite is the primary limiting factor; no end-user interaction is required (UI:N).

This is a genuine but access-gated risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) shows a network-reachable, low-complexity attack with no user interaction, but PR:H means the attacker must already hold WordPress administrator privileges - a significant barrier that sharply limits the realistic threat population to insiders, compromised admin accounts, or chained privilege escalation. The 8.6 score (driven by VC:H/VI:H/VA:H via potential RCE) overstates standalone urgency because the high-privilege precondition is doing a lot of work; this is better characterized as a post-authentication integrity/confidentiality escalation than a mass-exploitable perimeter flaw. No EPSS score, KEV listing, or SSVC decision data was provided in the input, so exploitation-probability and automatability signals cannot be evaluated. There is no public exploit identified at time of analysis and no indication of active exploitation. Net: a real priority for environments where admin access is shared, delegated, or weakly protected, but a lower practical priority than its CVSS number suggests for single-admin or hardened deployments.

An authenticated WordPress administrator (or an attacker who has already hijacked an admin session or account) uploads a maliciously crafted migration ZIP whose entry names contain path-traversal sequences. During import, computeExtractionParameters() and resumableZipExtractor() write those entries outside the intended extraction directory - for example dropping a PHP webshell into a web-served path - and the attacker then requests that file to achieve remote code execution. No public proof-of-concept was identified at time of analysis.