WordPress Prime Mover Plugin PHP Object Injection Vulnerability

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 2.2.1. The flaw exists in the migration search-and-replace routine (recursiveUnserializeReplace()) due to deserialization of untrusted input.

An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator later performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction.

• Affected versions: all versions up to and including 2.2.1
• Attack vector: unauthenticated comment submission
• Impact: PHP Object Injection via a POP chain present in the plugin's bundled Freemius library
• No additional plugin or theme required; the plugin ships the gadget itself