BackWPup – WordPress Backup & Restore Plugin Security & Risk Analysis

BackWPup v5.6.6 presents a mixed security posture. While the plugin demonstrates good practices in areas like SQL prepared statements and output escaping, a significant concern arises from its attack surface. A considerable number of AJAX handlers lack proper authentication checks, creating potential entry points for unauthorized actions if exploited. The taint analysis, fortunately, did not reveal any critical or high severity unsanitized path flows, which is a positive sign. However, the plugin's vulnerability history is a major red flag. With 10 known CVEs, including one critical and five high-severity vulnerabilities, and common types like missing authorization, path traversal, and information exposure, it indicates a recurring pattern of security weaknesses. The presence of past critical and high-severity issues, despite the absence of currently unpatched vulnerabilities, suggests a need for heightened vigilance and potentially deeper code auditing. The last recorded vulnerability in 2026 also indicates a recent history of security issues, making proactive patching and hardening crucial.