PLUGIN SECURITY
Is Backup Backup safe?
Backup, migrate, and create staging sites with free cloud storage and support.
What this plugin does
- Slug:
backup-backup - Author: Inisev
- 80000+ active installs
- 98/100 rating (1340 reviews on wordpress.org)
- 2676380 all-time downloads
- On WordPress.org since 2020-12-01
backupbackupsmigratemigrationstaging
Maintenance status
- Last updated: 2026-11-10 2:51pm GMT
- Tested up to WordPress: 7.1.4
- Requires PHP: 5.6+
- Max supported PHP (analyzed): <8.0
Known vulnerabilities
19 known CVEs on file for Backup Backup. Reported between 2021 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-127050 | Backup Migration [backup-backup] < 2.1.8 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | High 7.1 | < 2.1.8 | 2.1.8 | 2026-11-12 | — |
| CVE-2026-18216 | Backup Migration [backup-backup] < 2.1.7 | Improper Authentication | Unknown | < 2.1.7 | 2.1.7 | 2026-08-15 | — |
| CVE-2026-7693 | Backup Migration [backup-backup] < 2.1.5.2 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | High 7.2 | < 2.1.5.2 | 2.1.5.2 | 2026-08-04 | — |
| CVE-2026-39480 | Backup Migration [backup-backup] < 2.1.2 | Insertion of Sensitive Information Into Sent Data | High 7.5 | < 2.1.2 | 2.1.2 | 2026-04-08 | — |
| CVE-2025-14944 | Backup Migration [backup-backup] < 2.1.0 | Missing Authorization | Medium 5.3 | < 2.1.0 | 2.1.0 | 2026-04-06 | — |
| CVE-2025-12394 | Backup Migration [backup-backup] < 2.0.0 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.9 | < 2.0.0 | 2.0.0 | 2025-11-03 | — |
| CVE-2024-10932 | Backup Migration [backup-backup] < 1.4.6.1 | Deserialization of Untrusted Data | High 8.8 | < 1.4.6.1 | 1.4.6.1 | 2025-01-03 | — |
| CVE-2023-38514 | Backup Migration [backup-backup] < 1.2.8 | Missing Authorization | Medium 4.3 | < 1.2.8 | 1.2.8 | 2024-12-13 | — |
+ 16 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2024-31435 | Backup Migration [backup-backup] < 1.4.2 | Missing Authorization | Medium 4.3 | < 1.4.2 | 1.4.2 | 2024-04-26 | — |
| CVE-2024-32686 | Backup Migration [backup-backup] < 1.4.4 | Insertion of Sensitive Information into Log File | Medium 5.3 | < 1.4.4 | 1.4.4 | 2024-04-17 | — |
| CVE-2023-6971 | Backup Migration [backup-backup] >= 1.0.8 - <= 1.3.9 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | Critical 9.8 | 1.0.8–1.4.0 | 1.4.0 | 2023-12-22 | — |
| CVE-2023-6972 | Backup Migration [backup-backup] < 1.4.0 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Critical 9.8 | < 1.4.0 | 1.4.0 | 2023-12-22 | — |
| CVE-2023-7002 | Backup Migration [backup-backup] < 1.4.0 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | High 7.2 | < 1.4.0 | 1.4.0 | 2023-12-22 | — |
| CVE-2023-6553 | Backup Migration [backup-backup] < 1.3.8 | Improper Control of Generation of Code ('Code Injection') | Critical 9.8 | < 1.3.8 | 1.3.8 | 2023-12-11 | — |
| CVE-2023-6271 | Backup Migration [backup-backup] < 1.3.6 | Exposure of Sensitive Information to an Unauthorized Actor | High 7.5 | < 1.3.6 | 1.3.6 | 2023-12-07 | — |
| CVE-2023-6266 | Backup Migration [backup-backup] < 1.3.7 | Exposure of Sensitive Information to an Unauthorized Actor | High 7.5 | < 1.3.7 | 1.3.7 | 2023-11-30 | — |
| — | Backup Migration [backup-backup] < 1.3.0 | — | Unknown | < 1.3.0 | 1.3.0 | 2023-09-06 | — |
| — | Backup Migration [backup-backup] < 1.3.0 | — | Unknown | < 1.3.0 | 1.3.0 | 2023-09-05 | — |
| CVE-2023-0958, CVE-2023-38514 | Backup Migration [backup-backup] < 1.2.8 | Missing Authorization | Medium 6.5 | < 1.2.8 | 1.2.8 | 2023-07-27 | — |
| CVE-2023-3977 | Backup Migration [backup-backup] < 1.2.8 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 1.2.8 | 1.2.8 | 2023-07-27 | — |
| — | Backup Migration [backup-backup] == 1.2.8 (unfixed) | — | High 7.5 | < 1.2.8 | 1.2.8 | 2023-05-10 | — |
| CVE-2021-36884 | Backup Migration [backup-backup] < 1.1.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 1.1.6 | 1.1.6 | 2021-11-17 | — |
| — | Backup Migration [backup-backup] < 1.3.0 | — | Unknown | < 1.3.0 | 1.3.0 | — | — |
| — | Backup Migration < 1.3.0 - Cross-Site Request Forgery | — | Unknown | < 1.3.0 | 1.3.0 | — | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- All-in-One WP Migration and Backup — 5000000+ active installs — 90/100 (7677) — max PHP <8.0
- UpdraftPlus: WP Backup & Migration Plugin — 4000000+ active installs — 96/100 (8727) — max PHP <8.0
- Jetpack – AI Agents & MCP, Security, Backup & Analytics — 3000000+ active installs — 74/100 (2411)
- Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More — 1000000+ active installs — 98/100 (4941)
- ManageWP Worker — 1000000+ active installs — 92/100 (680) — max PHP <8.0
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.