Read the docs
TI-2026-65195 Aliases CVE-2026-101888GHSA-53gh-jq4p-v6wx

Prime Mover < 2.2.1 Zip Slip Path Traversal File Write

Priority MEDIUM 40CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php to write attacker-controlled content to arbitrary filesystem locations, potentially achieving remote code execution if the written files are interpreted by the web environment.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00573 47th percentileScored 2026-11-07
Fix Fixed Prime Mover (Codexonics): 2.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CodexonicsPrime Moverbefore 2.2.12.2.1Patch availableCNA
  • Prime Mover VendorCodexonics Affected before 2.2.1 Fixed in 2.2.1 Patch available CNA

Remediation

  • Fix · CNA Prime Mover (Codexonics) Fixed in 2.2.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Codexonics Prime Mover 2.2.1

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-65196 Prime Mover < 2.2.1 Path Traversal via wprime-config.jsonPriority LOW 31
    • TI-2026-65197 Prime Mover < 2.2.1 Stored XSS via Package MetadataPriority LOW 22
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-101888
  2. 2026-10-03 Alias added: GHSA-53gh-jq4p-v6wx

References

Patch 1

  • TI-2023-05962 Prime Mover < 1.9.3 - Directory Listing to Sensitive Data Exposure CVSS 3.1HIGH 7.5
  • TI-2026-80028 Unauthenticated PHP object injection in Prime Mover WordPress plugin CVSS 3.1CRITICAL 9.8
  • TI-2026-65196 Prime Mover < 2.2.1 Path Traversal via wprime-config.json CVSS 4.0HIGH 7.0
  • TI-2022-04562 Freemius SDK <= 2.4.2 - Missing Authorization Checks CVSS 3.1MEDIUM 6.3
  • TI-2026-65197 Prime Mover < 2.2.1 Stored XSS via Package Metadata CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences