Backuply – Backup, Restore, Migrate and Clone Security & Risk Analysis

The Backuply plugin exhibits a mixed security posture. While it demonstrates good practices in using prepared statements for SQL queries and a high percentage of properly escaped output, significant concerns arise from its attack surface. A large number of unprotected AJAX handlers (24 out of 34) present a substantial entry point for attackers to potentially exploit vulnerabilities. The presence of the `unserialize` function, especially in conjunction with unsanitized paths identified in the taint analysis, raises red flags for potential remote code execution or arbitrary file read/write vulnerabilities. The plugin's historical vulnerability record, with 5 known CVEs including a critical and a high-severity issue, further exacerbates these concerns. The fact that the last vulnerability was in 2025-09-25, and there are currently no unpatched vulnerabilities, suggests a potential for past issues being fixed but also highlights the plugin's track record. Overall, the plugin's large attack surface and historical issues warrant careful consideration, despite some positive coding practices.