Skip to content
PluginCanary

UpdraftPlus: WP Backup & Migration Plugin

by David Anderson / Team Updraft · 4,000,000+ active installs · Checked 3 Nov 2026
Healthy2 Warnings

Healthy: vulnerability published 25 Sep 2026, fixed in 1.26.8.

84/ 100 Canary Score
Sub-scores for UpdraftPlus: WP Backup & Migration Plugin
Ownership100
Maintenance100
Security65
Support82
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 25 Sep 2026, fixed in 1.26.8. Update to version 1.26.8 or later.25 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 27 Aug 2026, fixed in 1.26.7. Update to version 1.26.7 or later.27 Aug 2026Evidence
  • InfoSEC-35 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
DavidAnderson22 May 2012 to 26 Oct 2026, 1825 commits

1 committer recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
8 days ago
Releases, 24 months
28
Tested up to
7.1 current
Requires PHP
not stated supported 8.2+
Releases per quarter for UpdraftPlus: WP Backup & Migration Plugin
Q1 20242
Q2 20241
Q3 20243
Q4 20246
Q1 20253
Q2 20252
Q3 20251
Q4 20252
Q1 20262
Q2 20263
Q3 20263
Q4 20266

Last release 26 Oct 2026. Tested with WordPress 7.1 (current).

Support

82% of 49 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
25 Sep 2026UpdraftPlus 1.23.8 - 1.26.7 - Authenticated (Subscriber+) Information Exposure4.31.23.8 to 1.26.7, 2.26 to 2.26.8.261.26.80
27 Aug 2026UpdraftPlus: WP Backup & Migration Plugin < 1.26.7 - Cross-Site Request Forgery4.3< 1.26.71.26.70
10 Jun 2026UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 (free) < 2.26.5 (premium) - Unauthenticated Authentication Bypass via UpdraftCentral udrpc9.82.0 to 2.26.52.26.50
15 Jan 2025UpdraftPlus - Backup/Restore <= 1.24.12 - Reflected Cross-Site Scripting6.1<= 1.24.121.25.10
3 Jan 2025UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection8.81.23.8 to 1.24.111.24.120
7 Nov 2023UpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update5.4<= 1.23.101.23.110
18 May 2023UpdraftPlus <= 1.23.3 - Cross-Site Request Forgery to Cross-Site Scripting via action_authenticate_storage6.1<= 1.23.31.23.40
16 Mar 2023UpdraftPlus 1.22.14 to 1.23.2 and UpdraftPlus (Premium) 2.22.14 to 2.23.2 - Privilege Escalation via updraft_central_ajax_handler8.81.22.14 to 1.23.2, 2.22.14 to 2.23.21.23.31
8 Mar 2023Updraft Plus <= 1.22.24 - Information Disclosure via updraft_ajaxrestore5.3<= 1.22.241.23.11
7 Apr 2022UpdraftPlus WordPress Backup Plugin < 1.22.9 Reflected Cross-Site Scripting6.1< 1.22.91.22.90
17 Feb 2022UpdraftPlus WordPress Backup Plugin < 1.22.3 - Sensitive Information Disclosure6.51.16.7 to 1.22.31.22.30
28 Dec 2021UpdraftPlus WordPress Backup Plugin <= 1.16.68 - Reflected Cross-Site Scripting via updraft_restore6.10.7.4 to 1.16.681.16.691
6 Dec 2021UpdraftPlus WordPress Backup Plugin <= 1.16.65 - Reflected Cross-Site Scripting6.1< 1.16.661.16.660
12 Jul 2021UpdraftPlus < 1.16.59 - Authenticated (Admin+) Local File Inclusion7.2<= 1.16.561.16.595
9 May 2021UpdraftPlus WordPress Backup Plugin < 1.6.59 - Stored Cross-Site Scripting4.8< 1.6.591.6.59n/a
22 Sep 2020UpdraftPlus <= 1.9.63 and UpdraftPlus (paid) <= 2.9.63 - Cross-Site Scripting6.1< 1.9.641.9.640
8 Aug 2017UpdraftPlus <= 1.13.4 - Stored Cross-Site Scripting5.4<= 1.13.41.13.51
20 Apr 2015UpdraftPlus WordPress Backup <= 1.9.6.3 - Cross-Site Scripting6.1<= 1.9.6.31.9.6.4n/a
3 Feb 2015UpdraftPlus WordPress Backup Plugin <= 1.9.50 - Nonce Leak to Authorization Bypass9.9< 1.9.511.9.510

Source: Wordfence Intelligence.

Reputation

Average rating 4.5 in Q4 2026.

Rating distribution
5 star8199
4 star166
3 star54
2 star44
1 star247
Latest low reviews

Momentum

4,000,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for UpdraftPlus: WP Backup & Migration Plugin
4 May 20261,153,667
11 May 2026286,695
18 May 2026297,157
25 May 2026178,111
1 Jun 20261,210,811
8 Jun 2026557,141
15 Jun 2026235,107
22 Jun 2026155,731
29 Jun 2026143,204
6 Jul 2026120,901
13 Jul 2026115,954
20 Jul 20261,219,416
27 Jul 2026306,217
3 Aug 2026306,858
10 Aug 2026154,123
17 Aug 20261,202,487
24 Aug 2026363,028
31 Aug 2026238,752
7 Sep 2026161,570
14 Sep 2026210,808
21 Sep 20261,510,808
28 Sep 2026244,209
5 Oct 2026188,598
12 Oct 20263,199,110
19 Oct 20261,053,344
26 Oct 20261,490,263
2 Nov 202655,978

Weekly downloads over the last 4 weeks are 139% above the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

BlogVault Backup & StagingScore 91 · 80,000+Jetpack VaultPress BackupScore 91 · 20,000+Jetpack VaultPressScore 91 · 10,000+Backuply - Backup, Restore, Migrate and CloneScore 90 · 600,000+Royal WordPress Backup, Restore & Migration Plugin - Backup WordPress Sites SafelyScore 90 · 30,000+

Facts

Version1.26.14
AuthorDavid Anderson / Team Updraft
Added22 May 2012
Last updated26 Oct 2026
Active installs4,000,000+
Requires WordPress3.9
Tested up to7.1.4
Requires PHPnot stated
CategorySite Administration & Utilities > Site Migration & Cloning
Tagsbackup, migration, cloud backup, database backup, wordpress backup

Other plugins by this author: All-In-One Security (AIOS) - Security and Firewall, WP-Optimize - Cache, Compress images, Minify & Clean database to boost page speed & performance, Redux Framework, Easy Updates Manager, Internal Link Juicer: SEO Auto Linker for WordPress, Two Factor Authentication, WPGet API - Connect to any external REST API, Upload Larger Plugins, UpdraftCentral Dashboard, Testimonial Slider, European VAT Compliance Assistant for WooCommerce, Use Administrator Password

Questions

Is UpdraftPlus: WP Backup & Migration Plugin still maintained?

UpdraftPlus: WP Backup & Migration Plugin was last updated on 26 Oct 2026. Its Canary status is Healthy.

Is UpdraftPlus: WP Backup & Migration Plugin safe?

UpdraftPlus: WP Backup & Migration Plugin has no open unpatched vulnerabilities on record. 5 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns UpdraftPlus: WP Backup & Migration Plugin?

The wordpress.org author is David Anderson / Team Updraft. Recent committers: DavidAnderson, plugin-master. We have recorded no ownership change.

What can I use instead of UpdraftPlus: WP Backup & Migration Plugin?

Plugins in the same category with a higher Canary Score: BlogVault Backup & Staging, Jetpack VaultPress Backup, Jetpack VaultPress, Backuply - Backup, Restore, Migrate and Clone, Royal WordPress Backup, Restore & Migration Plugin - Backup WordPress Sites Safely.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue