Skip to content
PluginCanary

Duplicator - Backups & Migration Plugin - Cloud Backups, Scheduled Backups, & More

by Syed Balkhi · 1,000,000+ active installs · Checked 3 Nov 2026
Healthy2 Warnings

Healthy: vulnerability published 23 Oct 2026, fixed in 5.0.0.

93/ 100 Canary Score
Sub-scores for Duplicator - Backups & Migration Plugin - Cloud Backups, Scheduled Backups, & More
Ownership100
Maintenance100
Security80
Support100
Reputation85

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 23 Oct 2026, fixed in 5.0.0. Update to version 5.0.0 or later.23 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 20 Oct 2026, fixed in 5.0.0. Update to version 5.0.0 or later.20 Oct 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
[email protected]7 Jun 2011 to 16 Nov 2022, 1198 commits
bobriley9 Aug 2016 to 27 Jun 2022, 14 commits
seedprod21 Dec 2022 to 4 Jun 2024, 52 commits
andreamk16 Nov 2023 to 3 Nov 2026, 82 commits

4 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
yesterday
Releases, 24 months
20
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for Duplicator - Backups & Migration Plugin - Cloud Backups, Scheduled Backups, & More
Q1 20242
Q2 20242
Q3 20243
Q4 20242
Q1 20251
Q2 20250
Q3 20254
Q4 20251
Q1 20262
Q2 20261
Q3 20267
Q4 20263

Last release 3 Nov 2026. Tested with WordPress 7.1 (current).

Support

100% of 17 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
23 Oct 2026Duplicator <= 1.5.17 - Authenticated (Multisite Subsite Admin+) Arbitrary Code Execution7.2<= 1.5.175.0.00
20 Oct 2026Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection8.8<= 1.5.175.0.00
10 Jul 2024Duplicator <= 1.5.9 - Full Path Disclosure5.3<= 1.5.91.5.100
27 Dec 2023Duplicator <= 1.5.7 - Cross-Site Request Forgery via views/tools/diagnostics/information.php4.3<= 1.5.71.5.7.10
15 Dec 2023Duplicator < 1.3.0 - Unauthenticated Remote Code Execution9.8< 1.3.01.3.00
4 Dec 2023Duplicator <= 1.5.7 AND Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Information Exposure9.8<= 1.5.71.5.7.10
27 Jul 2022Duplicator – WordPress Migration Plugin <= 1.4.7 - Sensitive Information Disclosure7.5<= 1.4.71.4.7.18
27 Jul 2022Duplicator – WordPress Migration Plugin <= 1.4.7 - Unauthenticated Backup Download9.8<= 1.4.71.4.7.18
28 Feb 2020Duplicator < 1.3.28 - Directory Traversal7.5< 1.3.281.3.280
29 Aug 2018Duplicator <= 1.2.41 - Sensitive Information Disclosure leading to Remote Code Execution9.8<= 1.2.401.2.420
15 Mar 2018Duplicator <= 1.2.32 - Cross-Site Scripting6.1<= 1.2.321.2.33n/a
7 Nov 2017Duplicator <= 1.2.28 – Unauthenticated Stored Cross-Site Scripting6.1<= 1.2.281.2.307
9 Feb 2016Duplicator < 1.1.4 - Cross-Site Request Forgery6.5< 1.1.41.1.41
15 Aug 2015Duplicator <= 0.5.26 - Authenticated (Admin+) Cross-Site Scripting5.5< 0.5.280.5.284
10 Apr 2015Duplicator <= 0.5.14 - SQL Injection8.8<= 0.5.140.5.160
19 Feb 2015Duplicator < 0.5.10 - Arbitrary Backup Creation and Download8.2< 0.5.100.5.100
1 Aug 2014Duplicator – WordPress Migration Plugin <= 0.4.4 - Cross-Site Scripting6.1<= 0.4.40.4.50

Source: Wordfence Intelligence.

Reputation

Average rating rose from 4.9 to 5.0 between Q3 2026 and Q4 2026.

Rating distribution
5 star4695
4 star63
3 star21
2 star22
1 star139
Latest low reviews

Momentum

1,000,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Duplicator - Backups & Migration Plugin - Cloud Backups, Scheduled Backups, & More
4 May 202621,414
11 May 202643,217
18 May 2026401,485
25 May 2026122,253
1 Jun 202678,684
8 Jun 202665,014
15 Jun 202656,619
22 Jun 202649,828
29 Jun 202648,997
6 Jul 202683,405
13 Jul 202644,140
20 Jul 202647,525
27 Jul 202643,994
3 Aug 202641,653
10 Aug 202636,206
17 Aug 202637,134
24 Aug 2026383,119
31 Aug 2026111,377
7 Sep 2026738,899
14 Sep 2026776,674
21 Sep 2026155,244
28 Sep 2026423,712
5 Oct 2026140,540
12 Oct 2026404,074
19 Oct 2026151,959
26 Oct 2026481,584
2 Nov 202621,614

Weekly downloads over the last 4 weeks are 43% above the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

No healthier plugin in the same category yet.

Facts

Version5.1.1
AuthorSyed Balkhi
Added7 Jun 2011
Last updated3 Nov 2026
Active installs1,000,000+
Requires WordPress6.2
Tested up to7.1.4
Requires PHP7.4
CategorySecurity & Privacy > Backup & Restore
Tagsbackup, migration, cloud backup, database backup, wordpress backup

Other plugins by this author: WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More, WP Mail SMTP by WPForms - SMTP for Reliable Email Delivery with Gmail, Outlook, Amazon SES, Brevo, Other SMTP & More, WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager, All in One SEO - AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights), Smash Balloon Social Photo Feed - Easy Social Feeds Plugin, Popup Builder & Popup Maker for WordPress - OptinMonster Email Marketing and Lead Generation, One Click Demo Import, Easy WP SMTP - WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more, Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery, WP Crontrol, PDF Embedder - PDF Viewer & Embed PDF Files for WordPress, WP Mail Logging

Questions

Is Duplicator - Backups & Migration Plugin - Cloud Backups, Scheduled Backups, & More still maintained?

Duplicator - Backups & Migration Plugin - Cloud Backups, Scheduled Backups, & More was last updated on 3 Nov 2026. Its Canary status is Healthy.

Is Duplicator - Backups & Migration Plugin - Cloud Backups, Scheduled Backups, & More safe?

Duplicator - Backups & Migration Plugin - Cloud Backups, Scheduled Backups, & More has no open unpatched vulnerabilities on record. 2 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns Duplicator - Backups & Migration Plugin - Cloud Backups, Scheduled Backups, & More?

The wordpress.org author is Syed Balkhi. Recent committers: andreamk, seedprod, [email protected], bobriley, plugin-master. We have recorded no ownership change.

What can I use instead of Duplicator - Backups & Migration Plugin - Cloud Backups, Scheduled Backups, & More?

We have no healthier plugin in the same category on record yet.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue