All-in-One WP Migration and Backup

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Modeled within the band wp.org reports; tightens as we track daily.

A large install base, a clear pro tier and a steady trend. As reliable as an outside estimate gets.

The newest reviews report the latest version breaking local backups and failing imports, plus anger over paywalled restores and poor refund handling, a sharp drop from the praise earlier reviewers gave for painless migrations.

1. ★★★★★ chinnailu

   1mo ago

   I had high hopes on this plugin, but it does not work. They say we should set the limit to 512MB. I have increased to 1 GB, still same issue. I updated all the parameters for more execution time, everything, still it keeps asking to pay money to get over it. Avoid this.

   Read on wp.org ↗
2. ★★★★★ zeezuiper

   2mo ago

   In the latest version you can’t use local backup files anymore so you must upload your webfile via the browser, which aint working because the file size.

   Read on wp.org ↗
3. ★★★★★ nowaythis

   3mo ago

   Greedy company with poor values and horrid customer service. Their yearly subscription email warning landed in my spam, I contacted them ON THE DAY of the payment to cancel my subscription and get a refund and was met only with poor manners and a terrible service. Avoid this plugin and company at all costs, just do a simple search and you will find better FREE alternatives. Do not throw your money at them. This topic was modified 1 month, 1 week ago by nowaythis.

   Read on wp.org ↗
4. ★★★★★ petrosf17

   3mo ago

   Made the transition from localhost easy

   Read on wp.org ↗
5. ★★★★★ ddzc

   3mo ago

   This piece of crap exports np but then gives a ton of issues when trying to import, constantly failing. Piece of garbage!

   Read on wp.org ↗
6. ★★★★★ Scarlett

   3mo ago

   was rly stressed about moving my site but this made it so easy. took just a few mins and nothing broke. saved me from a major headache tbh. tnkz This topic was modified 1 month, 2 weeks ago by Scarlett.

   Read on wp.org ↗
7. ★★★★★ kryllyn

   3mo ago

   Current version of the plugin have inner (hidden) limit for file size – you can’t upload the backup even with limits on the server that exceeds backup’s file size.

   Read on wp.org ↗
8. ★★★★★ kaiasteffen

   3mo ago

   moved my site with this n it was a breeze tbh. just 1 click n everything packed up perfectly. saves sm time when u dont wanna mess with files or DB manually. totally a lifesaver, def 5 stars

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 7.106 Added REST API for AI-native WordPress migration Fixed Unauthenticated path traversal in ai1wm_error_path. Special thanks to Jakub Herman for responsibly disclosing this issue SQLite export producing invalid MySQL CREATE 7.106
2. — Version 7.105 Fixed PHP 8.5 “Cannot use bool as array” fatal error in export pipeline when reading past end-of-file Database column name replacement incorrectly matching column type keywords (e.g., UUID) in database tables 7.105
3. — Version 7.104 Added CRC32 checksum integrity verification for wpress archive file format Fixed Infinite loop in compressor when timeout fires at exact end-of-file boundary Improved Minimum required versions enforcement for extensions 7.104
4. — Version 7.103 Added MariaDB-specific database driver with support for INET4, INET6, UUID, XMLTYPE, and VECTOR column types Server version parsing utility for improved database version detection Fixed Path traversal vulnerability in do 7.103
5. — Version 7.102 Added Clean storage folder option on backups page Archive validation before listing files for improved reliability Minimum required versions check Fixed Offset handling in archiver for correct data processing File extrac 7.102
6. — Version 7.101 Fixed File size and modification time type handling in archive for improved compatibility with PHP strict mode Post revisions exclusion to properly exclude associated postmeta entries during export Improved Upgraded to f 7.101

16 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. High · 8.8 All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution ↗
   2026-08-24 CVE-2026-19949 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 7.109 Patched in 7.110
2. High · 7.2 All-in-One WP Migration and Backup < 7.108 - Authenticated (Administrator+) Remote Code Execution ↗
   2026-08-20 CVE-2026-17533 Improper Control of Generation of Code ('Code Injection') Affects < 7.108 Patched in 7.108
3. Medium · 5.3 All-in-One WP Migration and Backup <= 7.105 - Missing Authorization ↗
   2026-06-29 CVE-2026-12898 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 7.105 Patched in 7.106
4. Medium · 4.4 All-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import ↗
   2025-08-26 CVE-2025-8490 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.97 Patched in 7.98
5. High · 7.5 All in One WP Migration <= 7.89 - Unauthenticated PHP Object Injection ↗
   2025-03-12 CVE-2024-10942 Deserialization of Untrusted Data Affects <= 7.89 Patched in 7.90
6. High · 7.2 All-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection ↗
   2024-10-27 CVE-2024-9162 Improper Control of Generation of Code ('Code Injection') Affects <= 7.86 Patched in 7.87
7. Medium · 5.3 All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs ↗
   2024-10-21 CVE-2024-8852 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 7.86 Patched in 7.87
8. Medium · 6.1 All-in-One WP Migration <= 7.62 - Unauthenticated Reflected Cross-Site Scripting ↗
   2022-08-23 CVE-2022-2546 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.62 Patched in 7.63
9. Medium · 5.5 All-in-One WP Migration <= 7.62 - Authenticated (Admin+) Cross-Site Scripting ↗
   2022-08-15 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.62 Patched in 7.63
10. Medium · 6.6 All-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows Hosts ↗
    2022-04-28 CVE-2022-1476 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 7.58 Patched in 7.59
11. High · 7.2 All-in-One WP Migration <= 7.40 - Authenticated (Admin+) Arbitrary File Upload ↗
    2022-02-07 CVE-2021-24216 Unrestricted Upload of File with Dangerous Type Affects <= 7.40 Patched in 7.41
12. Medium · 5.9 All-in-One WP Migration <= 7.14 - Unauthenticated Backup Download ↗
    2020-01-20 Use of Insufficiently Random Values Affects < 7.15 Patched in 7.15
13. Medium · 5.5 All-in-One WP Migration <= 6.97 - Authenticated Stored Cross-Site Scripting ↗
    2019-07-18 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 7.0 Patched in 7.0
14. Medium · 6.1 All-in-One WP Migration <= 6.45 - Reflected Cross-Site Scripting ↗
    2017-06-20 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 6.46 Patched in 6.46
15. High · 7.5 All-in-One WP Migration <= 2.0.4 - Missing Authorization to Database Export ↗
    2015-03-19 Improper Authentication Affects <= 2.0.4 Patched in 2.0.5
16. High · 8.8 All-in-One WP Migration <= 2.0.2 - Authorization Bypass to Arbitrary File Upload ↗
    2014-11-05 Unrestricted Upload of File with Dangerous Type Affects <= 2.0.2 Patched in 2.0.3

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 85 languages, 23 at 90% or more

Plus 61 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

No tier crossings observed yet.

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• WPvivid — Backup, Migration & Staging 900K+ installs · 4.9★ · 3 shared tags A
• Clone 40K+ installs · 4.1★ · 3 shared tags B
• InstaWP Connect – 1-click WP Staging & Migration 40K+ installs · 4.2★ · 3 shared tags A
• 1-Click Backup & Migration 400+ installs · 4.4★ · 3 shared tags A
• ManageWP Worker 1M+ installs · 4.6★ · 2 shared tags A
• WP Migrate Lite – Migration Made Easy 200K+ installs · 4.2★ · 2 shared tags A

Embed this report card

Drop a live Pulse card for All-in-One WP Migration and Backup into a readme, a review or a deck. It updates itself.

All-in-One WP Migration and Backup: 5M+ active installs, 4.5★ (7,663 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/all-in-one-wp-migration