# Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

> The best WordPress backup and migration plugin. Quickly and easily backup ,migrate, copy, move, or clone your site from one location to another.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-06 04:19 UTC.

## Facts (WordPress.org)

- Slug: `duplicator`
- Author: Syed Balkhi
- Version: 5.1.1
- Active installs: 1+ million
- Last update: 2026-11-03 (3 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.2, PHP 7.4
- Tags: backup, cloud backup, database backup, migration, wordpress backup
- Page: https://wordpress.org/plugins/duplicator/

## Checks (against WordPress 7.1.4)

- OK: Updated 3 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Flaky ↔ Reliable, Paywalled ↔ Generous, Slow ↔ Responsive, Behind ↔ Current, Heavy ↔ Light, Pushy ↔ Fair.

## Known vulnerabilities

- 2026-11-04 MEDIUM: Unauthenticated Full Path Disclosure (before 5.1.0). WF-3f809bde-56a5-4fd1-9cc7-bfc0c91487d6-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/3f809bde-56a5-4fd1-9cc7-bfc0c91487d6?source=api-prod
- 2026-11-02 MEDIUM: Reflected Cross-Site Scripting (before 5.1.0). WF-103c39ca-b5fa-43da-91d9-29357e54e432-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/103c39ca-b5fa-43da-91d9-29357e54e432?source=api-prod
- 2026-11-02 MEDIUM: Authenticated (Subscriber+) SQL Injection (before 5.1.0). WF-6dc64359-969e-4eb2-8c17-0be680b9808f-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc64359-969e-4eb2-8c17-0be680b9808f?source=api-prod
- 2026-10-25 HIGH: Authenticated (Multisite Subsite Admin+) Arbitrary Code Execution (up to 1.5.17). CVE-2026-115251, https://www.wordfence.com/threat-intel/vulnerabilities/id/7c0a75f2-be2e-4764-8a1d-c916c8132b06?source=api-prod
- 2026-10-20 HIGH: Unauthenticated PHP Object Injection (up to 1.5.17). CVE-2026-82814, https://www.wordfence.com/threat-intel/vulnerabilities/id/767fb03a-58a3-464b-98b2-5378cfec09ae?source=api-prod
- 2024-07-10 MEDIUM: Full Path Disclosure (up to 1.5.9). CVE-2024-6210, https://www.wordfence.com/threat-intel/vulnerabilities/id/d47d582d-7c90-4f49-aee1-03a8775b850d?source=api-prod
- 2023-12-27 MEDIUM: Cross-Site Request Forgery via views/tools/diagnostics/information.php (up to 1.5.7). CVE-2023-51681, https://www.wordfence.com/threat-intel/vulnerabilities/id/416da5d4-3d47-443b-a82c-c059c38f5218?source=api-prod
- 2023-12-15 CRITICAL: Unauthenticated Remote Code Execution (before 1.3.0). CVE-2018-25095, https://www.wordfence.com/threat-intel/vulnerabilities/id/c5757abd-33dc-4751-bc55-afd944ff2341?source=api-prod
- 2023-12-04 CRITICAL: Unauthenticated Sensitive Information Exposure (up to 1.5.7). WF-b3f7a88c-a09b-46ac-b345-139c2d20a3d2-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/b3f7a88c-a09b-46ac-b345-139c2d20a3d2?source=api-prod
- 2022-07-27 HIGH: Sensitive Information Disclosure (up to 1.4.7). CVE-2022-2552, https://www.wordfence.com/threat-intel/vulnerabilities/id/843ef712-6ca6-44d2-825f-7ce9a82d74e6?source=api-prod
- 2022-07-27 CRITICAL: Unauthenticated Backup Download (up to 1.4.7). CVE-2022-2551, https://www.wordfence.com/threat-intel/vulnerabilities/id/b5136409-d843-4774-afe7-211a23f65da9?source=api-prod
- 2020-02-28 HIGH: Directory Traversal (before 1.3.28). WF-f9ae9aba-fa0e-4a3d-a970-e45216685cc0-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/f9ae9aba-fa0e-4a3d-a970-e45216685cc0?source=api-prod
- 2018-08-29 CRITICAL: Sensitive Information Disclosure leading to Remote Code Execution (up to 1.2.40). CVE-2018-17207, https://www.wordfence.com/threat-intel/vulnerabilities/id/aff754d6-8624-4068-8e31-738f6041d3a6?source=api-prod
- 2018-03-15 MEDIUM: Cross-Site Scripting (up to 1.2.32). CVE-2018-7543, https://www.wordfence.com/threat-intel/vulnerabilities/id/010ce1c3-dd07-4ed6-8908-0909c0842be8?source=api-prod
- 2017-11-07 MEDIUM: Duplicator <= 1.2.28 – Unauthenticated Stored Cross-Site Scripting (up to 1.2.28). CVE-2017-16815, https://www.wordfence.com/threat-intel/vulnerabilities/id/9bdf7b10-6a3e-47aa-86ae-479b4cd29c49?source=api-prod
- 2016-02-09 MEDIUM: Cross-Site Request Forgery (before 1.1.4). WF-3f753961-3eeb-402d-876f-4a4dea41a96a, https://www.wordfence.com/threat-intel/vulnerabilities/id/3f753961-3eeb-402d-876f-4a4dea41a96a?source=api-prod
- 2015-08-15 MEDIUM: Authenticated (Admin+) Cross-Site Scripting (before 0.5.28). WF-06905738-7e1c-4d1a-97d2-f68f978ad8ed, https://www.wordfence.com/threat-intel/vulnerabilities/id/06905738-7e1c-4d1a-97d2-f68f978ad8ed?source=api-prod
- 2015-04-10 HIGH: SQL Injection (up to 0.5.14). WF-3762cd92-604a-4dac-a09e-6b4a08c4d804, https://www.wordfence.com/threat-intel/vulnerabilities/id/3762cd92-604a-4dac-a09e-6b4a08c4d804?source=api-prod
- 2015-02-19 HIGH: Arbitrary Backup Creation and Download (before 0.5.10). CVE-2014-9262, https://www.wordfence.com/threat-intel/vulnerabilities/id/b85b44ed-94cd-4d85-bcc5-60b50cdb94f1?source=api-prod
- 2014-08-01 MEDIUM: Cross-Site Scripting (up to 0.4.4). CVE-2013-4625, https://www.wordfence.com/threat-intel/vulnerabilities/id/1b69831e-19ab-4812-b657-dc4febe15077?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=duplicator · HTML: https://todaywp.com/plugins/duplicator