Plugin vulnerabilities
Is BackWPup safe? Known vulnerabilities and the version to run.
BackWPup: schedules backups of files and the database to cloud storage.
The short answer
Run BackWPup 5.7.7 or later. That version has a fix for every known vulnerability that's been patched.
- Known vulnerabilities
- 16
- In the last 12 months
- 7
- Rated high or critical
- 8
- No fix yet
- 0
Every known BackWPup vulnerability
Newest first. The most recent was disclosed on 8 October 2026. Each one links to its full record on Wordfence.
| Vulnerability | Severity | Affected versions | Fixed in |
|---|---|---|---|
| Unauthenticated Information ExposureCVE-2026-86826 · 8 October 2026 | Medium 5.3 | before 5.7.7 | 5.7.7 |
| BackWPup – WordPress Backup & Restore Plugin 3.3 - 5.7.6 - Missing AuthorizationCVE-2026-86827 · 8 October 2026 | Medium 5.3 | 3.3 to 5.7.6 | 5.7.7 |
| Authenticated (Administrator+) Path TraversalCVE-2026-86828 · 8 October 2026 | Medium 4.9 | before 5.7.7 | 5.7.7 |
| BackWPup – WordPress Backup & Restore Plugin 5.2.2 - 5.7.4 - Missing AuthorizationCVE-2026-86815 · 11 September 2026 | Medium 4.3 | 5.2.2 to 5.7.4 | 5.7.5 |
| Unauthenticated Stored Cross-Site ScriptingCVE-2026-65443 · 27 July 2026 | High 7.2 | 5.7.4 and earlier | 5.7.5 |
| Authenticated (Administrator+) Local File Inclusion via 'block_name' ParameterCVE-2026-6227 · 13 April 2026 | High 7.2 | 5.6.6 and earlier | 5.6.7 |
| BackWPup 5.0.0 - 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options UpdateCVE-2025-15041 · 18 February 2026 | High 7.2 | 5.0.0 to 5.6.2 | 5.6.3 |
| BackWPup 5 - 5.5.0 - Missing Authorization to Sensitive Information ExposureCVE-2025-10579 · 24 October 2025 | Medium 5.3 | 5 to 5.5.0 | 5.5.1 |
| Authenticated (Administrator+) Directory TraversalCVE-2023-5505 · 16 August 2024 | Medium 6.8 | 4.0.1 and earlier | 4.0.2 |
| Plaintext Storage of Backup Destination PasswordCVE-2023-5775 · 23 February 2024 | Low 2.2 | 4.0.2 and earlier | 4.0.3 |
| Sensitive Information ExposureCVE-2023-7164 · 18 December 2023 | High 7.5 | 4.0.3 and earlier | 4.0.4 |
| Authenticated (Administrator+) Directory TraversalCVE-2023-5504 · 22 November 2023 | High 8.7 | 4.0.1 and earlier | 4.0.2 |
| Unauthenticated Backup DownloadCVE-2017-2551 · 8 September 2017 | High 7.5 | before 3.4.2 | 3.4.2 |
| Cross-Site ScriptingCVE-2013-4626 · 21 August 2013 | Medium 6.1 | before 3.0.13 | 3.0.13 |
| Remote File InclusionCVE-2011-4342 · 28 March 2011 | Critical 9.8 | 1.7.1 and earlier | 1.7.2 |
| Directory TraversalCVE-2011-5208 · 2 March 2011 | High 7.5 | before 1.4.1 | 1.4.1 |
If you run BackWPup
What to do now
- Check your version. In WordPress, go to Plugins and look under BackWPup. Compare it with the affected versions above.
- Update to 5.7.7 or later. Take a backup first, then update. If the update breaks something, you can restore the backup while you work out why.
- Check the rest of your site. One outdated plugin is rarely the only one. Our free security check looks at your WordPress version, and the plugins and theme it can see from the outside, for known flaws and emails you a report.
Pressfort keeps your plugins up to date for you, testing each update on a copy of your site first, and its virtual patching blocks attacks on newly disclosed flaws, often before a fix is out. If your site does get hacked, two clean-ups a year are included, with a developer stepping in when needed. See how it works.
Backups and migration
Related plugins
All-in-One WP Migration
A plugin for moving a WordPress site to a new host or domain.
18 known5 in the last year
UpdraftPlus
A backup plugin that saves copies of your site to cloud storage.
20 known4 in the last year
Duplicator
A plugin for migrating, copying and backing up WordPress sites.
20 known5 in the last year
WPvivid
Backs up, migrates and stages WordPress sites, with copies kept on the server or in cloud storage.
37 known13 in the last year
Backuply
Backs up WordPress sites to the server or cloud storage, with one-click restores.
6 known1 in the last year
Data sources and licences
Vulnerability data comes from Wordfence Intelligence and is refreshed daily. Severity is the CVSS score given in each record. Pressfort is not affiliated with Wordfence or Defiant Inc.
Copyright 2012-2026 Defiant Inc.
Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Copyright 1999-2026 The MITRE Corporation
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
Not sure yet?
Find out how exposed your site is.
Send us your site address and get a free, plain-English report of what we find. We check from the outside, so there are no logins to hand over and nothing to install.
- Known vulnerability in 1 pluginGallery plugin, file upload flawUrgent
- WordPress is out of dateRunning 6.7.1, latest is 6.8.3To fix
- 6 plugins and 1 theme out of dateOldest is 14 months behindTo fix