Handoffs
Write what the file is claimed to carry
Separate the object from the proof. A sender's sentence is not a completed check.
nvd.nist.gov published this account (2026-10-24): New CVE published by Wordfence (CNA) at 05:17Z. All versions up to and including 2.2.1 are affected: an unauthenticated attacker stores a base64 serialized object in a comment via wp-comments-post.php; when an admin later runs a Prime Mover export or restore, recursiveUnserializeReplace() calls unserialize() with no allowed_classes, and a POP chain in the bundled Freemius library (FS_Clone_Manager -> FS_Option_Manager::set_option -> update_option) allows arbitrary option writes. WordPress.org plugin directory lists 2.2.2 (updated 2026-10-19) as current; about 10,000 active installs.
This guide uses that public page as the example. This site did not run the test, close the deal, or measure the product.
Write only what the page says
The page's claim is: New CVE published by Wordfence (CNA) at 05:17Z. All versions up to and including 2.2.1 are affected: an unauthenticated attacker stores a base64 serialized object in a comment via wp-comments-post.php; when an admin later runs a Prime Mover export or restore, recursiveUnserializeReplace() calls unserialize() with no allowed_classes, and a POP chain in the bundled Freemius library (FS_Clone_Manager -> FS_Option_Manager::set_option -> update_option) allows arbitrary option writes. WordPress.org plugin directory lists 2.2.2 (updated 2026-10-19) as current; about 10,000 active installs.
Put the URL under that sentence. If a later recap adds a number or a date, keep the original page as the record.
Separate the object from the proof. A sender's sentence is not a completed check.
Do the site's check on this one page. Fill a line only when the page supports it. Where the page is silent, write Not stated.
A finished note names the page, the date, and the limit of the claim. It does not borrow a result from a different story.
Stop at the untested line
Anything you did not open, install, or count stays untested. Leave that line visible.
Source page: Prime Mover – Backup and Migration (WordPress plugin) unauthenticated PHP Object Injection, CVE-2026-115806 (CVSS 9.8).