Prime Mover 2.2.2 – User privacy feature and maintenance updates

Change log

• Feature: Added support for PRO feature: user sanitization and privacy during export/import.
• Security: Hardened unserialize implementation to prevent object injection. (Credit: Civitasmass/Wordfence)
• Fixed: Updated Freemius SDK to the latest version.

User privacy feature

This version ships a new feature that could dramatically enhance your site users’ privacy when moving staging/development sites. Moving live WordPress websites to staging or development environments with real customer and administrator data introduces significant privacy risks and the constant danger of accidental outbound notifications hitting real user inboxes. Adopting user sanitization as a standard workflow best practice keeps sensitive personal information protected during third-party agency handoffs or remote debugging, while eliminating the risk of spamming real clients with test emails or password resets.

Prime Mover PRO makes this entire security workflow effortlessly simple and intuitive. With automated credential masking, secure key-derived temporary passwords, and flexible email options (like Safe-Discard and Developer plus-addressing modes), you can sandbox your site in seconds. Best of all, Prime Mover’s intelligent reverse-import technology makes the process fully reversible: it automatically aligns and syncs sanitized development accounts back to your live production database during deployment without overwriting real production passwords or creating duplicate users.

For details on this new PRO feature, please check out this tutorial:

Security: Hardened unserialize implementation

Starting in Prime Mover 2.2.2, the unserialize calls now implement a hardened approach:

@unserialize($serialized_string, [
                'allowed_classes' => [
                    'stdClass', 
                ]
            ]);

This is safe because it prevents objects from being instantiated except stdClass, which certain page builders like Beaver Builder require.

Since it no longer instantiates objects, a possible side effect is that if your plugin stores URLs or paths inside a serialized custom object, Prime Mover 2.2.2+ search-and-replace will now bypass it. The only workaround is to manually replace these URLs or paths using the Better Search and Replace plugin after import.

The probability, though, that a custom plugin stores custom serialized objects in the database and uses URLs and paths is extremely low. Most URLs and paths today are now either stored as JSON objects or stdClass serialized objects, which are fully supported by Prime Mover’s search and replace feature.

Maintenance updates

In addition to this release, we also updated the Freemius SDK and many other dependencies to their latest versions. If you have any questions, please contact us here.