Vulnerability feed

Executive summary

The Prime Mover Backup and Migration plugin for WordPress has a flaw that lets an unauthenticated attacker plant malicious data through the comment form, which can be triggered when an administrator runs a routine export or restore. The advisory describes this as a PHP Object Injection issue that can enable serious compromise of the site. The advisory text provided does not state a fixed version or the vendor's specific recommendations.

Technical summary

The flaw is PHP Object Injection caused by unsafe deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker stores a base64-encoded serialized object in wp_comments.comment_content through wp-comments-post.php, and it is later decoded and passed to unserialize() without allowed_classes restriction when an administrator performs an export or restore. The advisory states a POP chain exists in the bundled Freemius library, so no additional plugin is required. All versions up to and including 2.2.1 are described as vulnerable. A fixed version, workaround, CVSS score, and detection guidance are not stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

CodexonicsPrime MoverFreemiusCodexonics Prime Mover – Backup and MigrationPrime Mover – Backup and MigrationFreemius