CVE-2026-101888
Received Received - Intake

Zip Slip Path Traversal in Prime Mover WordPress Plugin

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: VulnCheck

Description
The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php to write attacker-controlled content to arbitrary filesystem locations, potentially achieving remote code execution if the written files are interpreted by the web environment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-101888
EUVD
EUVD-2026-90911

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
prime_mover plugin to 2.2.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Zip Slip path traversal vulnerability in the Prime Mover WordPress plugin before version 2.2.1. It allows authenticated administrators to write arbitrary files outside the intended extraction directory during ZIP import operations. Attackers can craft ZIP files with special path sequences to place files in unintended locations on the server.

Detection Guidance

To detect this vulnerability, check the installed version of the Prime Mover plugin in your WordPress environment. If the version is below 2.2.1, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly. Monitor for unexpected file writes outside the intended directories during ZIP import operations.

Impact Analysis

An attacker with admin access could write malicious files to arbitrary locations on the server. If these files are executed by the web server, it could lead to remote code execution, allowing full control over the affected WordPress site and potentially the underlying server.

Compliance Impact

This vulnerability could lead to unauthorized file access or code execution, potentially compromising sensitive data. This may violate compliance requirements for data protection and security, such as GDPR's integrity and confidentiality principles or HIPAA's security rule for protecting electronic protected health information.

Mitigation Strategies

Immediately update the Prime Mover WordPress plugin to version 2.2.1 or later to patch the Zip Slip vulnerability. If updating is not possible, disable the plugin until an update is applied to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101888. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart