Skip to content
Sign in
8.6 High

CVE-2026-101888 The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows…

Description

The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php to write attacker-controlled content to arbitrary filesystem locations, potentially achieving remote code execution if the written files are interpreted by the web environment.

Affected products and versions

Product Affected versions Fixed in
Prime Mover 2.2 earliest → < 2.2.1 2.2.1

Other CVEs of Prime Mover

The 3 CVEs of Prime Mover →
CVE-2026-101890 The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows… 5.1 Medium CVE-2026-101889 The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated… 7.0 High
Track this CVE