Backup Migration

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 65% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. The recent download trend is too spiky to read.

1. ★★★★★ dphill26

   1mo ago

   I needed a simple/free way to take the start of my localhost site and add it to my bluehost live site. Every other plugin required the premium version and I literally only needed to use a plugin this one time. I installed Backup Migration and was pleased to have my site up so I can continue working on it without jumping through hoops. Thanks!

   Read on wp.org ↗
2. ★★★★★ Nikodemsky

   1mo ago

   Not many free plugins allow uploading to cloud storage and add custom exclude filters on top of that. Kudos to you. That said, I have few issues with the overall experience: 1. The UI simply sucks – honestly guys, take an afternoon off to check how user experience should look in an app; there are too many accordions and popups, and everything’s just way too big… and that carousel in backups management is the cherry on top. 2. Second point off goes to “premium locked” options – I know that you have to make your business somehow, but there’s simply too much – to the point it actually annoys users when trying to set things up. 3. Why do you have 500kb+ svg’s for simple backgrounds? That alone takes almost 2MB of package size. There are a lot of other small things, like importing additional font to the admin panel or loading a lot of assets for simple things like promo banner/carousel. I’ll be happy to re-evaluate if you’ll consider changing things for the better.

   Read on wp.org ↗
3. ★★★★★ hoshheather

   2mo ago

   I installed this to enable me to duplicate pages and it works very well for that. Haven’t used the other functionality.

   Read on wp.org ↗
4. ★★★★★ michaelswerdloff

   2mo ago

   Did exactly what I needed it to do.

   Read on wp.org ↗
5. ★★★★★ tbombadil81

   2mo ago

   Really handy and easy to use!

   Read on wp.org ↗
6. ★★★★★ happy29451

   2mo ago

   Very easy to use.簡単操作で素早く引っ越しが出来るプラグインです。

   Read on wp.org ↗
7. ★★★★★ cambsac

   2mo ago

   Very easy and does a great job

   Read on wp.org ↗
8. ★★★★★ fainson

   2mo ago

   Its a wonderfull plugin and easy to use

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 2.1.6 [FEATURE] Added direct-to-cloud streaming configuration, notices, and validation checks. [FEATURE] Added file integrity verification with chained hash calculation for streamed backups. [FEATURE] Added manifest-based MD5 2.1.6
2. — Version 2.1.5.2 Tested with WordPress 7.0 [FIX] Sanitized backup file and URL arguments in AJAX requests to improve security and input validation. 2.1.5.2
3. — Version 2.1.5 [FEATURE] Introduced file restoration in batches with progress and category logging. [FEATURE] Added conditional file restoration for first-time setup scenarios. [FEATURE] Implemented reconstruction of local staging site 2.1.5
4. — Version 2.1.4 [FIX] Ensured restore success modal appears correctly after restore completion. [FIX] Corrected SQL LIKE statement escaping for accurate query handling and improved security. 2.1.4
5. — Version 2.1.3 [FEATURE] Enhanced backup banner with improved initialization logic, positioning, and transition effects. [FEATURE] Added delayed banner display after 5 minutes of initialization. [FEATURE] Implemented dynamic arrow posi 2.1.3
6. — Version 2.1.7 Tested with WordPress 7.0.3 [FEATURE] Added WP-CLI commands for backup, restore, and quick migration operations. [FEATURE] Added remote execution support for scheduled backups with improved cron logging and management. [ 2.1.7

18 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. High · 7.2 Backup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' Parameter ↗
   2026-08-04 CVE-2026-7693 Improper Neutralization of Special Elements used in a Command ('Command Injection') Affects <= 2.1.1 Patched in 2.1.5.2
2. Medium · 5.3 BackupBliss – Backup & Migration with Free Cloud Storage <= 2.1.1 - Unauthenticated Information Exposure ↗
   2026-04-08 CVE-2026-39480 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.1.1 Patched in 2.1.2
3. Medium · 5.3 Backup Migration <= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storage ↗
   2026-04-06 CVE-2025-14944 Missing Authorization Affects <= 2.0.0 Patched in 2.1.0
4. High · 7.5 Backup Migration <= 1.4.9 - Information Exposure to Unauthenticated Back-up Download ↗
   2025-11-03 CVE-2025-12394 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.4.9 Patched in 2.0.0
5. High · 8.8 Backup Migration <= 1.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialize_replace' ↗
   2025-01-03 CVE-2024-10932 Deserialization of Untrusted Data Affects <= 1.4.6 Patched in 1.4.6.1
6. Medium · 5.3 Backup Migration <= 1.4.3 - Information Exposure via Log Files ↗
   2024-04-17 CVE-2024-32686 Insertion of Sensitive Information into Log File Affects <= 1.4.3 Patched in 1.4.4
7. Medium · 4.3 Inisev Analyst Module <= Various Versions - Missing Authorization ↗
   2024-04-10 CVE-2024-31435 Missing Authorization Affects <= 1.4.1 Patched in 1.4.2
8. Critical · 9.8 Backup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion ↗
   2023-12-22 CVE-2023-6972 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 1.3.9 Patched in 1.4.0
9. High · 8.1 Backup Migration 1.0.8 - 1.3.9 - Remote File Inclusion via content-dir ↗
   2023-12-22 CVE-2023-6971 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Affects 1.0.8 - 1.3.9 Patched in 1.4.0
10. High · 7.2 Backup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url ↗
    2023-12-22 CVE-2023-7002 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Affects <= 1.3.9 Patched in 1.4.0
11. Critical · 9.8 Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution ↗
    2023-12-11 CVE-2023-6553 Improper Control of Generation of Code ('Code Injection') Affects <= 1.3.7 Patched in 1.3.8
12. Critical · 9.8 Backup Migration <= 1.3.5 - Unauthenticated Sensitive Information Exposure ↗
    2023-12-07 CVE-2023-6271 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.3.5 Patched in 1.3.6
13. High · 7.5 Backup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure ↗
    2023-11-30 CVE-2023-6266 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.3.6 Patched in 1.3.7
14. Medium · 4.3 Backup Migration <= 1.2.9 - Cross-Site Request Forgery ↗
    2023-09-05 Cross-Site Request Forgery (CSRF) Affects < 1.3.0 Patched in 1.3.0
15. Medium · 4.3 Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function ↗
    2023-07-27 CVE-2023-3977 Cross-Site Request Forgery (CSRF) Affects <= 1.2.7 Patched in 1.2.8
16. Medium · 4.3 Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function ↗
    2023-07-27 CVE-2023-0958 Missing Authorization Affects <= 1.2.7 Patched in 1.2.8
17. High · 7.5 Backup Migration <= 1.2.8 - Sensitive Information Exposure ↗
    2023-05-10 CVE-2023-54346 Insertion of Sensitive Information into Externally-Accessible File or Directory Affects <= 1.2.8 Patched in 1.2.9
18. Medium · 5.5 Backup Migration <= 1.1.5 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2021-11-17 CVE-2021-36884 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.1.5 Patched in 1.1.6

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 36 languages, 13 at 90% or more

Plus 12 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-06-13 90K+ → 80K+ down after 76 days in tier
2. 2026-03-29 100K+ → 90K+ down after 48 days in tier
3. 2026-02-09 90K+ → 100K+ up after 1 days in tier
4. 2026-02-08 100K+ → 90K+ down after 85 days in tier
5. 2025-11-15 90K+ → 100K+ up after 64 days in tier
6. 2025-09-12 80K+ → 90K+ up after 145 days in tier
7. 2025-04-20 90K+ → 80K+ down after 1 days in tier
8. 2025-04-19 80K+ → 90K+ up after 21 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• WPvivid — Backup, Migration & Staging 900K+ installs · 4.9★ · 3 shared tags A
• BlogVault Backup & Staging 80K+ installs · 4.5★ · 3 shared tags A
• InstaWP Connect – 1-click WP Staging & Migration 40K+ installs · 4.2★ · 3 shared tags A
• Backup and Staging by WP Time Capsule 10K+ installs · 4.0★ · 3 shared tags B
• FastDup – Fastest WordPress Migration & Duplicator 5K+ installs · 4.4★ · 3 shared tags A
• Aruba Migration Tool 600+ installs · 3.7★ · 3 shared tags B

Embed this report card

Drop a live Pulse card for Backup Migration into a readme, a review or a deck. It updates itself.

Backup Migration: 80K+ active installs, 4.9★ (1,330 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/backup-backup