PLUGIN SECURITY
Is Duplicator safe?
The best WordPress backup and migration plugin. Quickly and easily backup ,migrate, copy, move, or clone your site from one location to another.
What this plugin does
- Slug:
duplicator - Author: Syed Balkhi
- 1000000+ active installs
- 98/100 rating (4940 reviews on wordpress.org)
- 57544468 all-time downloads
- On WordPress.org since 2011-06-07
backupcloud backupdatabase backupmigrationwordpress backup
Maintenance status
- Latest known version: 1.5.16.1
- Last updated: 2026-10-14 4:53pm GMT
- Tested up to WordPress: 7.1.3
- Requires PHP: 7.4+
- Max supported PHP (analyzed): <8.0
Known vulnerabilities
13 known CVEs on file for Duplicator. Reported between 2013 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-82814 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 5.0.0 | Deserialization of Untrusted Data | High 8.8 | < 5.0.0 | 5.0.0 | 2026-10-21 | ⚠ update needed |
| CVE-2024-6210 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 1.5.10 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 1.5.10 | 1.5.10 | 2024-07-10 | ✓ fixed in latest |
| CVE-2023-51681 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 1.5.7.1 | Cross-Site Request Forgery (CSRF) | Medium 6.5 | < 1.5.7.1 | 1.5.7.1 | 2023-12-27 | ✓ fixed in latest |
| CVE-2018-25095 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 1.3.0 | Improper Control of Generation of Code ('Code Injection') | Critical 9.8 | < 1.3.0 | 1.3.0 | 2023-12-15 | ✓ fixed in latest |
| CVE-2023-6114 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 1.5.7.1 | Exposure of Sensitive Information to an Unauthorized Actor | High 7.5 | < 1.5.7.1 | 1.5.7.1 | 2023-12-04 | ✓ fixed in latest |
| CVE-2022-2552 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 1.4.7.1 | Missing Authentication for Critical Function | Medium 5.3 | < 1.4.7.1 | 1.4.7.1 | 2022-07-27 | ✓ fixed in latest |
| CVE-2022-2551 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 1.4.7.1 | Direct Request ('Forced Browsing') | High 7.5 | < 1.4.7.1 | 1.4.7.1 | 2022-07-27 | ✓ fixed in latest |
| CVE-2020-11738 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 1.3.28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | High 7.5 | < 1.3.28 | 1.3.28 | 2020-02-28 | ✓ fixed in latest |
+ 22 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| — | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 1.3.28 | — | Unknown | < 1.3.28 | 1.3.28 | 2020-02-20 | ✓ fixed in latest |
| — | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 1.2.42 | — | Unknown | < 1.2.42 | 1.2.42 | 2018-09-05 | ✓ fixed in latest |
| CVE-2018-17207 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 1.2.42 | Improper Control of Generation of Code ('Code Injection') | Critical 9.8 | < 1.2.42 | 1.2.42 | 2018-08-29 | ✓ fixed in latest |
| CVE-2018-7543 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 1.2.33 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.2.33 | 1.2.33 | 2018-03-15 | ✓ fixed in latest |
| CVE-2017-16815 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 1.2.30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.2.30 | 1.2.30 | 2017-11-07 | ✓ fixed in latest |
| — | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 1.1.4 | — | Unknown | < 1.1.4 | 1.1.4 | 2016-02-11 | ✓ fixed in latest |
| — | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 1.1.4 | — | Unknown | < 1.1.4 | 1.1.4 | 2016-02-09 | ✓ fixed in latest |
| — | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 0.5.28 | — | Unknown | < 0.5.28 | 0.5.28 | 2015-11-22 | ✓ fixed in latest |
| — | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 0.5.28 | — | Unknown | < 0.5.28 | 0.5.28 | 2015-08-15 | ✓ fixed in latest |
| — | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 0.5.15 | — | Unknown | < 0.5.15 | 0.5.15 | 2015-04-13 | ✓ fixed in latest |
| — | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 0.5.16 | — | Unknown | < 0.5.16 | 0.5.16 | 2015-04-10 | ✓ fixed in latest |
| CVE-2014-9262 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 0.5.10 | — | High 8.2 | < 0.5.10 | 0.5.10 | 2015-02-19 | ✓ fixed in latest |
| CVE-2013-4625 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 0.4.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 0.4.5 | 0.4.5 | 2013-08-09 | ✓ fixed in latest |
| — | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 0.4.5 | — | Unknown | < 0.4.5 | 0.4.5 | 2013-07-24 | ✓ fixed in latest |
| — | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 1.2.42 | — | Unknown | < 1.2.42 | 1.2.42 | — | ✓ fixed in latest |
| — | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 1.1.4 | — | Unknown | < 1.1.4 | 1.1.4 | — | ✓ fixed in latest |
| — | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 0.5.28 | — | Unknown | < 0.5.28 | 0.5.28 | — | ✓ fixed in latest |
| — | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator] < 0.5.16 | — | Unknown | < 0.5.16 | 0.5.16 | — | ✓ fixed in latest |
| — | Duplicator < 0.5.16 - SQL Injection & CSRF | — | Unknown | < 0.5.16 | 0.5.16 | — | ✓ fixed in latest |
| — | Duplicator < 0.5.28 - Authenticated Cross-Site Scripting (XSS) | — | Unknown | < 0.5.28 | 0.5.28 | — | ✓ fixed in latest |
| — | Duplicator <= 1.1.3 - Cross-Site Request Forgery (CSRF) | — | Unknown | < 1.1.4 | 1.1.4 | — | ✓ fixed in latest |
| — | Duplicator < 1.2.42 - Unauthenticated Arbitrary Code Execution | — | Unknown | < 1.2.42 | 1.2.42 | — | ✓ fixed in latest |
How to fix it
Keep Duplicator updated — 1.5.16.1 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- All-in-One WP Migration and Backup — 5000000+ active installs — 90/100 (7674) — max PHP <8.0
- UpdraftPlus: WP Backup & Migration Plugin — 3000000+ active installs — 96/100 (8696) — max PHP <8.0
- Jetpack – WP Security, Backup, Speed, & Growth — 3000000+ active installs — 74/100 (2406)
- ManageWP Worker — 1000000+ active installs — 92/100 (679) — max PHP <8.0
- WPvivid — Backup, Migration & Staging — 900000+ active installs — 98/100 (1566) — max PHP <8.0
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.