---
id: CVE-2026-101888
title: >-
  The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path
  traversal vulnerability that allows authenticated administrators to write
  arbitrary files outside the intended extraction directory during migration ZIP
  import
summary: >-
  The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path
  traversal vulnerability that allows authenticated administrators to write
  arbitrary files outside the intended extraction directory during migration ZIP
  import. A…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-22
vendor: Codexonics
product: Prime Mover
affected:
  - prime_mover < 2.2.1
published: '2026-10-01'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T18:00:34.733'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-101888'
references:
  - url: 'https://wordpress.org/plugins/prime-mover/#developers'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/prime-mover-zip-slip-path-traversal-file-write
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00573
epssPercentile: 0.47135
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-01T18:03:29.194293Z'
ingestedAt: '2026-10-01T18:55:42.358Z'
---

## Overview

The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php to write attacker-controlled content to arbitrary filesystem locations, potentially achieving remote code execution if the written files are interpreted by the web environment.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.