CVE-2026-101888
Prime Mover < 2.2.1 Zip Slip Path Traversal File Write
Codexonics Prime Mover
CVSS
8.6HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.59%Chance of exploitation activity in the next 30 days, higher than 47% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.2.1Prime MoverCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php to write attacker-controlled content to arbitrary filesystem locations, potentially achieving remote code execution if the written files are interpreted by the web environment.
Text from CVE List
Affected versions 1
- Prime Moveraffected: all versions before 2.2.1CVE List