What this plugin does

• Slug: all-in-one-wp-migration
• Author: ServMask
• 5000000+ active installs
• 90/100 rating (7664 reviews on wordpress.org)
• 186642427 all-time downloads
• On WordPress.org since 2014-01-07

backupcloneexport-importmigratemove wordpress

Maintenance status

• Latest known version: 7.107
• Last updated: 2026-08-20 11:33am GMT
• Tested up to WordPress: 7.1
• Requires PHP: 5.3+
• Max supported PHP (analyzed): <8.0

Known vulnerabilities

10 known CVEs on file for All-in-One WP Migration and Backup.

+ 20 more known vulnerabilities

CVE	Vulnerability	Type	Severity	Affected	Fixed in	Published	Status
CVE-2022-1476	All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.59	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	Medium 6.5	< 7.59	7.59	2022-04-28	✓ fixed in latest
CVE-2021-24216	All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.41	Unrestricted Upload of File with Dangerous Type	High 7.2	< 7.41	7.41	2022-02-07	✓ fixed in latest
—	All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.15	—	Unknown	< 7.15	7.15	2020-03-25	✓ fixed in latest
—	All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.15	—	Unknown	< 7.15	7.15	2020-01-20	✓ fixed in latest
—	All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.0	—	Unknown	< 7.0	7.0	2019-07-18	✓ fixed in latest
—	All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.0	—	Unknown	< 7.0	7.0	2019-07-18	✓ fixed in latest
—	All-in-One WP Migration and Backup [all-in-one-wp-migration] < 6.46	—	Unknown	< 6.46	6.46	2017-06-20	✓ fixed in latest
—	All-in-One WP Migration and Backup [all-in-one-wp-migration] < 2.0.5	—	Unknown	< 2.0.5	2.0.5	2015-03-19	✓ fixed in latest
—	All-in-One WP Migration and Backup [all-in-one-wp-migration] < 2.0.5	—	Unknown	< 2.0.5	2.0.5	2015-03-19	✓ fixed in latest
—	All-in-One WP Migration and Backup [all-in-one-wp-migration] < 2.0.3	—	Unknown	< 2.0.3	2.0.3	2014-11-05	✓ fixed in latest
—	All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.98	—	Medium 4.4	< 7.98	7.98	0000-00-00	✓ fixed in latest
—	All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.15	—	Unknown	< 7.15	7.15	—	✓ fixed in latest
—	All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.0	—	Unknown	< 7.0	7.0	—	✓ fixed in latest
—	All-in-One WP Migration and Backup [all-in-one-wp-migration] < 6.46	—	Unknown	< 6.46	6.46	—	✓ fixed in latest
—	All-in-One WP Migration and Backup [all-in-one-wp-migration] < 2.0.5	—	Unknown	< 2.0.5	2.0.5	—	✓ fixed in latest
—	All-in-One WP Migration < 2.0.5 - Unauthenticated Database Export	—	Unknown	< 2.0.5	2.0.5	—	✓ fixed in latest
—	All-in-One WP Migration < 6.46 - Reflected Cross-Site Scripting (XSS)	—	Unknown	< 6.46	6.46	—	✓ fixed in latest
—	All-in-One WP Migration < 7.0 - Admin+ Stored XSS	—	Unknown	< 7.0	7.0	—	✓ fixed in latest
—	All-in-One WP Migration < 7.15 - Arbitrary Backup Download	—	Unknown	< 7.15	7.15	—	✓ fixed in latest
CVE-2025-8490	All-in-One WP Migration and Backup < 7.98 - Admin+ Stored XSS	—	Unknown	< 7.98	7.98	—	✓ fixed in latest

How to fix it

Keep All-in-One WP Migration and Backup updated — 7.107 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").

This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.

Safer / more established alternatives

• UpdraftPlus: WP Backup & Migration Plugin — 3000000+ active installs — 96/100 (8623) — max PHP <8.0
• Jetpack – WP Security, Backup, Speed, & Growth — 3000000+ active installs — 74/100 (2406)
• Yoast Duplicate Post — 3000000+ active installs — 94/100 (538) — max PHP 8.4
• Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More — 1000000+ active installs — 98/100 (4928) — max PHP <8.0
• ManageWP Worker — 1000000+ active installs — 92/100 (678) — max PHP <8.0