Prime Mover Backup And Migration
Monthly
Unauthenticated PHP object injection in the Prime Mover - Backup and Migration plugin for WordPress (all versions up to and including 2.2.1) allows an attacker to plant a base64-encoded serialized object in wp_comments.comment_content through the stock wp-comments-post.php endpoint, with no authentication and no user interaction required. The payload is only deserialized when an administrator later runs a Prime Mover export or restore, at which point recursiveUnserializeReplace() passes the attacker-controlled value to unserialize() without an allowed_classes restriction; the plugin additionally ships its own gadget chain inside the bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no third-party plugin or theme is needed. The two-stage nature means the storage half is always reachable on a site with comments enabled while the trigger half depends on an administrator using the migration features; impact on successful trigger is full confidentiality, integrity and availability loss. Priority is act_now per the current decision signals; no public exploit code has been identified at time of analysis.
Unauthenticated PHP object injection in the Prime Mover - Backup and Migration plugin for WordPress (all versions up to and including 2.2.1) allows an attacker to plant a base64-encoded serialized object in wp_comments.comment_content through the stock wp-comments-post.php endpoint, with no authentication and no user interaction required. The payload is only deserialized when an administrator later runs a Prime Mover export or restore, at which point recursiveUnserializeReplace() passes the attacker-controlled value to unserialize() without an allowed_classes restriction; the plugin additionally ships its own gadget chain inside the bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no third-party plugin or theme is needed. The two-stage nature means the storage half is always reachable on a site with comments enabled while the trigger half depends on an administrator using the migration features; impact on successful trigger is full confidentiality, integrity and availability loss. Priority is act_now per the current decision signals; no public exploit code has been identified at time of analysis.