CVE-2026-115806: Critical PHP Object Injection in WordPress Prime Mover Plugin — Detection, Hunting, and Remediation Guide

The NVD has published CVE-2026-115806, a CVSS 9.8 (Critical), remotely exploitable vulnerability in the Prime Mover – Backup and Migration plugin for WordPress. Every version of the plugin up to and including 2.2.1 is vulnerable to PHP Object Injection via insecure deserialization in the plugin's migration search-and-replace routine, recursiveUnserializeReplace().

What makes this bug genuinely dangerous is its two-stage, unauthenticated delivery mechanism. An attacker does not need credentials, a valid session, or any interaction with the WordPress admin dashboard. They simply submit a standard public comment through wp-comments-post.php containing a base64-encoded, crafted PHP serialized object. That payload sits dormant in wp_comments.comment_content until an administrator performs a routine Prime Mover export or restore — at which point the plugin base64-decodes the stored value and hands it directly to PHP's unserialize(). From that moment, the attacker controls a POP (Property-Oriented Programming) chain inside the WordPress codebase, which in practice means arbitrary file writes, arbitrary code execution, and full site compromise under the web server's context.

If you operate WordPress sites — especially multi-tenant hosting, agency-managed portfolios, or anything PCI-DSS / HIPAA adjacent where WordPress fronts patient or payment-adjacent data — this is a patch-and-hunt-today issue. Commenting is enabled by default on most WordPress deployments, which means the injection vector is exposed on an enormous percentage of vulnerable installs.

Technical Analysis

Affected Products and Versions

• Product: Prime Mover – Backup and Migration plugin for WordPress
• Vulnerable versions: All versions up to and including 2.2.1
• Platform: Any WordPress installation running the vulnerable plugin with public comment submission enabled (the default configuration)
• CVE / Score: CVE-2026-115806, CVSS 3.1 9.8 (Critical) — network attack vector, no privileges required, no user interaction required for the injection stage

How the Vulnerability Works

The flaw is a classic insecure deserialization weakness (CWE-502) with an unusually clean delivery path:

1. Payload staging (unauthenticated): The attacker submits a comment to any public post via wp-comments-post.php. The comment body contains a base64-encoded PHP serialized object crafted to exploit gadget chains present in WordPress core, the plugin itself, or co-installed plugins/themes.

2. Persistence in the database: The payload is stored verbatim in the wp_comments table, in the comment_content column. Because comment content is rarely inspected and almost never WAF-scrubbed for serialized-object signatures, the payload survives indefinitely — including across application-level logging blind spots.

3. Detonation (delayed, admin-triggered): When an administrator runs a Prime Mover export or restore, the migration engine walks site content performing search-and-replace. The recursiveUnserializeReplace() function encounters the stored comment value, base64-decodes it, and passes the result to unserialize() without validating the object type or restricting allowed classes.

4. POP chain execution: PHP instantiates the attacker's object graph. Magic methods (__wakeup(), __destruct(), __toString()) fire on attacker-controlled properties. Depending on available gadgets, this yields arbitrary file write (webshell drop into wp-content/uploads/ is the canonical outcome), SQL injection, or direct code execution.

Why This Is Worse Than a Typical Plugin Bug

• Unauthenticated injection, admin-grade blast radius: The exploit primitives are planted by an anonymous internet user, but the deserialization executes during a privileged backup/restore workflow.
• Stealth: The payload is a base64 blob in a comment table. It doesn't look like malware on disk, survives most file-integrity monitoring, and detonates only when an admin acts.
• Backup contamination: If a site is exploited before patching, the malicious comment rows are baked into subsequent Prime Mover backups — meaning a future restore can re-detonate the payload even after the plugin is updated.

Exploitation Status

As of publication, CVE-2026-115806 is newly published by NVD. There is no confirmed entry in CISA's Known Exploited Vulnerabilities catalog at the time of writing, and no public confirmation of mass exploitation. However, the vulnerability class (unauthenticated PHP object injection with a stored, delayed-detonation trigger) is one that exploit developers weaponize quickly — the staging step requires nothing more than a blog comment form. Defenders should assume a public PoC will follow shortly and treat the exposure window as active risk. Monitor the NVD entry and the CISA KEV catalog for status changes.

Detection & Response

The two highest-fidelity detection opportunities are (1) the comment-submission staging event — serialized-object signatures arriving in POST bodies to wp-comments-post.php — and (2) the post-exploitation artifacts — webshells dropped into wp-content/uploads/ and the web server process spawning unexpected child processes after an export/restore runs.

A key indicator for the staging event: base64-encoded PHP serialized objects almost always begin with O: (object) or a: (array). Their base64 forms start with predictable prefixes — Tz for O:, YT for a: — and contain recognizable substrings such as Tzo (O: encoded) and the base64 rendering of class-name length fields.

---
title: WordPress Comment Submission Containing Base64-Encoded PHP Serialized Object
description: Detects POST requests to the WordPress comment endpoint carrying base64-encoded PHP serialized object signatures, consistent with CVE-2026-115806 payload staging in wp_comments.comment_content.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-115806
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
status: experimental
date: 2026/06/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: apache
  service: access
detection:
  selection_uri:
    uri|contains: 'wp-comments-post.php'
    method: 'POST'
  selection_payload:
    request_body|contains:
      - 'Tzo'
      - 'Tzo0'
      - 'Tzo4'
      - 'YTo'
      - 'unserialize'
  condition: selection_uri and selection_payload
falsepositives:
  - Legitimate users pasting serialized data examples in comments on development blogs
level: high
---
title: Web Server Process Spawning Shell or Command Interpreter
description: Detects Apache, Nginx, or PHP-FPM worker processes spawning command interpreters, a common post-exploitation artifact of PHP Object Injection gadget chains achieving code execution (CVE-2026-115806 detonation during Prime Mover export/restore).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-115806
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
status: experimental
date: 2026/06/15
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-fpm8.1'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate plugins invoking system commands (e.g., image processing) — tune per environment
level: critical
---
title: PHP File Created in WordPress Uploads Directory
description: Detects creation of PHP files under wp-content/uploads, a canonical webshell drop location following PHP Object Injection exploitation via gadget chains with arbitrary file write primitives.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-115806
  - https://attack.mitre.org/techniques/T1505.003/
author: Security Arsenal
status: experimental
date: 2026/06/15
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/wp-content/uploads/'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.php5'
      - '.php7'
  condition: selection
falsepositives:
  - Very rare; uploads directories should never legitimately receive PHP files in normal WordPress operation
level: critical

// Hunt for CVE-2026-115806 staging: POSTs to wp-comments-post.php carrying serialized-object signatures
// Assumes web access logs ingested via CommonSecurityLog (CEF), Syslog, or W3CIISLog
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where RequestURL has "wp-comments-post.php" and RequestMethod =~ "POST"
| where Message has_any ("Tzo", "YTox", "unserialize", "base64_decode", "O:8:", "O:4:")
| project TimeGenerated, SourceIP, RequestURL, RequestMethod, Message, DestinationHostName
| order by TimeGenerated desc
;
// Fallback: Syslog-ingested Apache/Nginx access logs
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has "wp-comments-post.php" and SyslogMessage has "POST"
| where SyslogMessage has_any ("Tzo", "unserialize", "O:8:")
| project TimeGenerated, HostName, SyslogMessage
| order by TimeGenerated desc
;
// Post-exploitation: web server or PHP-FPM spawning shells (Defender for Endpoint on Linux, or MDE-managed web hosts)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("php-fpm", "apache2", "httpd", "nginx")
| where FileName has_any ("sh", "bash", "dash", "curl", "wget", "nc", "ncat", "python3", "perl")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc

-- Hunt for webshells dropped via CVE-2026-115806 POP chain file-write primitives
-- and suspicious child processes of the PHP/web server stack

-- Recently created PHP files anywhere under WordPress uploads directories
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='/**/wp-content/uploads/**/*.php')
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC

-- Shell or tooling children spawned by php-fpm / apache / nginx workers
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)^(sh|bash|dash|curl|wget|nc|ncat|python3?|perl)$'
  AND CommandLine =~ '(?i)(base64|/tmp/|eval|system\(|passthru)'

#!/bin/bash
# CVE-2026-115806 — Prime Mover PHP Object Injection: verify, patch, and sweep
# Run on the WordPress host (or container) with WP-CLI available.
set -euo pipefail

WP_PATH="/var/www/html"   # adjust to your WordPress root

# 1. Check installed Prime Mover version
echo "=== Prime Mover version ==="
wp --path="$WP_PATH" plugin get prime-mover --field=version 2>/dev/null || echo "Plugin not installed"

# 2. Update to the latest patched release (must be > 2.2.1)
echo "=== Updating Prime Mover ==="
wp --path="$WP_PATH" plugin update prime-mover
wp --path="$WP_PATH" plugin get prime-mover --field=version

# 3. Sweep the comments table for staged serialized-object payloads
echo "=== Scanning wp_comments for staged payloads ==="
mysql -u root -p wordpress -e \
"SELECT comment_ID, comment_date, comment_author_IP, LEFT(comment_content,80) AS snippet
 FROM wp_comments
 WHERE comment_content REGEXP '(Tzo[0-9]|O:[0-9]+:\\"|a:[0-9]+:\\{|unserialize|base64_decode)';"

# 4. Delete confirmed malicious comments (review output from step 3 first)
# wp --path="$WP_PATH" comment delete <comment_ID> --force

# 5. Hunt for webshells dropped in uploads
echo "=== PHP files in uploads (should be none) ==="
find "$WP_PATH/wp-content/uploads" -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) -mtime -30 -ls

# 6. Deny PHP execution in uploads as defense-in-depth (Apache)
cat > "$WP_PATH/wp-content/uploads/.htaccess" <<'EOF'
<FilesMatch "\.(php|phtml|phar|php[0-9])$">
  Require all denied
</FilesMatch>
EOF

echo "=== Done. Review output above before declaring clean. ==="

Remediation

Immediate actions (today):

1. Patch the plugin. Update Prime Mover – Backup and Migration to the fixed release immediately — any version newer than 2.2.1 published in the WordPress plugin repository. If a fixed build is not yet available in your region or repository mirror, deactivate and remove the plugin until it is. The exposure (unauthenticated, default-on comment vector) does not justify leaving it active.

2. Sweep the comments table before the next export/restore. The payload persists in wp_comments.comment_content independently of the plugin version. Patching the code does not remove already-staged payloads. Run the SQL sweep in the script above on every site that has ever run a vulnerable version, and delete suspicious comments before any admin runs Prime Mover again.

3. Treat existing backups as untrusted. Any Prime Mover backup taken while vulnerable may contain the staged payload. Quarantine pre-patch backups; do not restore from them without first scrubbing comment content.

Hardening (this week):

• Deny PHP execution in wp-content/uploads/ (see the .htaccess / nginx location block above). This neutralizes the most common file-write gadget outcome even if a future deserialization bug lands.
• Add a WAF rule blocking POST bodies to wp-comments-post.php that contain PHP serialization signatures (O:\\d+:, base64 prefixes Tzo, YTox). Test for false positives on developer communities where users legitimately paste code.
• Restrict or gate public comments on sites that don't need them (disable comments, require registration, or place the endpoint behind a CAPTCHA/bot control). This shrinks the injection surface to zero for most brochure and marketing sites.
• Alert on web-server child processes. The Sigma rule and KQL above give you durable coverage against any PHP object injection reaching code execution, not just this CVE.
• Enforce least privilege on the web database user and ensure unserialize() hardening where feasible (e.g., disallow object instantiation via allowed_classes => false patterns in custom code).

Verification and monitoring:

• Confirm the plugin version post-patch and re-run the comments sweep after 7 days to catch payloads staged during the exposure window.
• Watch the NVD entry for CVSS vector refinement and CISA KEV addition. If this lands in KEV, federal civilian agencies will face a binding BOD 22-01 remediation deadline, and all organizations should treat it as an emergency patch event.
• Review access logs retrospectively for comment-submission POST bursts from single IPs — attackers staging payloads across many posts generate distinctive volume signatures.

The broader lesson: deserialization bugs with stored triggers turn your database into the exploit delivery mechanism. File-based scanning will never catch them. If your WordPress estate is large enough that you can't enumerate every plugin version today, that inventory gap is itself the incident waiting to happen — close it.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub