PLUGIN SECURITY
Is WebToffee WP Backup and Migration safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the WebToffee WP Backup and Migration WordPress plugin — checked against WP Clinic's local security database.
What this plugin does
- Slug:
wp-migration-duplicator
Maintenance status
Known vulnerabilities
11 known CVEs on file for WebToffee WP Backup and Migration.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-120530 | WebToffee WP Backup and Migration [wp-migration-duplicator] < 1.6.2 | Improper Neutralization of Special Elements used in an SQL Command | Medium 5.7 | < 1.6.2 | 1.6.2 | 2026-09-28 | — |
| CVE-2025-24651 | WebToffee WP Backup and Migration [wp-migration-duplicator] < 1.5.4 | Insertion of Sensitive Information into Log File | Medium 5.9 | < 1.5.4 | 1.5.4 | 2025-01-13 | — |
| CVE-2026-97197 | WebToffee WP Backup and Migration [wp-migration-duplicator] < 1.6.1 | Missing Authorization | High 7.5 | < 1.6.1 | 1.6.1 | 2025-01-13 | — |
| CVE-2023-52183 | WebToffee WP Backup and Migration [wp-migration-duplicator] < 1.4.4 | Missing Authorization | Medium 5.4 | < 1.4.4 | 1.4.4 | 2024-06-11 | — |
| CVE-2024-3546 | WebToffee WP Backup and Migration [wp-migration-duplicator] < 1.4.9 | Missing Authorization | Medium 4.3 | < 1.4.9 | 1.4.9 | 2024-04-22 | — |
| CVE-2024-31254 | WebToffee WP Backup and Migration [wp-migration-duplicator] < 1.4.8 | Insertion of Sensitive Information into Log File | High 7.5 | < 1.4.8 | 1.4.8 | 2024-04-05 | — |
| CVE-2023-5738 | WebToffee WP Backup and Migration [wp-migration-duplicator] < 1.4.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.4.5 | 1.4.5 | 2023-11-08 | — |
| CVE-2023-5737 | WebToffee WP Backup and Migration [wp-migration-duplicator] < 1.4.4 | Missing Authorization | Medium 4.3 | < 1.4.4 | 1.4.4 | 2023-11-06 | — |
+ 3 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2023-45636 | WebToffee WP Backup and Migration [wp-migration-duplicator] < 1.4.2 | Missing Authorization | Medium 5.4 | < 1.4.2 | 1.4.2 | 2023-10-11 | — |
| CVE-2023-33928 | WebToffee WP Backup and Migration [wp-migration-duplicator] < 1.4.1 | Missing Authorization | Medium 4.3 | < 1.4.1 | 1.4.1 | 2023-05-24 | — |
| CVE-2023-5999 | WebToffee WP Backup and Migration [wp-migration-duplicator] < 1.4.5 | — | Unknown | < 1.4.5 | 1.4.5 | 0000-00-00 | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.