Home / Guides / Website Security
Website Security · 4 min readDuplicator and Backuply Security Fixes: Protect Your WordPress Backups
Duplicator and Backuply, two WordPress backup plugins, patched high-severity holes in October 2026. Check your plugin version and protect your backups.
In October 2026, two popular WordPress backup plugins, Duplicator and Backuply, fixed security holes rated "High," and if you use either one you should update it today. Both bugs come into play when you build, move or restore a backup. Here is what that means in plain words and what to do.
Why backup plugins matter for security
A backup plugin copies your whole site, including the database with every user, order and setting. When you restore or move a site, the plugin writes all of that back. That is a lot of power, so a bug in a backup tool can reach parts of your site most plugins never touch.
Duplicator and Duplicator Pro (CVE-2026-82814)
What the hole is: the CVE record calls it an "Unauthenticated PHP Object Injection" (CVE.org, Oct 21 2026). In plain words: someone who is not logged in could slip specially shaped data into public parts of your site. Later, when an admin builds a package or moves the site, the plugin could read that data in an unsafe way.
Severity: 8.8 out of 10, "High," as scored by Wordfence in the CVE record. The score notes that an admin has to take an action (building a package) for it to matter.
Affected versions:
- Duplicator: 1.5.17 and older
- Duplicator Pro: 4.6.10 and older
Fix: update to the newest version. The CVE record links to the vendor's changelog for version 5.0.0 as the fix (Duplicator changelog).
Backuply (CVE-2026-93953)
What the hole is: a "second-order SQL injection" (Patchstack, Oct 15 2026). SQL injection means sneaking commands into your database. Second-order means the bad data is saved first and only causes harm later. Here, a logged-in user with the lowest role (Subscriber) could put bad text in their profile. When an admin later restores a backup, that text could change the database. The CVE title says this can lead to "privilege escalation," which means a low-level user gaining more power.
Severity: 8.0 out of 10, "High" (CVE.org, Oct 16 2026).
Affected versions: 1.5.8 and older. Fixed in: 1.5.9.
Who is at risk?
- Sites running the affected versions above.
- For Backuply, sites that let people register as users are most exposed, because the bug starts with a Subscriber account. Shops, membership sites and sites with open sign-up fall in this group.
- For Duplicator, the risk shows up when an admin builds a package or migrates the site.
How to check your plugin version
- Log in to WordPress.
- Go to Plugins, then Installed Plugins.
- Find Duplicator, Duplicator Pro or Backuply. The version is shown under the name.
If an update is ready, you'll see a notice under the plugin.
What to do today
- Update the plugin to the newest version.
- Make a fresh backup with the updated plugin. Use that new backup from now on.
- Hold off on restores and migrations until you are on the fixed version.
- Review your users. Go to Users and remove accounts you don't recognise or no longer need.
- Check "Anyone can register." Under Settings, then General, turn it off if you don't need open sign-up. If you do need it, make sure "New User Default Role" is Subscriber or Customer, never anything higher.
- Delete backup plugins you don't use. Many sites have two or three installed from past moves.
- Store backups off the server, for example in cloud storage, so they are safe if the site is hit.
A note on old backups
Updating the plugin fixes how new backups and restores work. It does not rewrite backups you made before. To be safe, make a fresh backup after updating, check it, and use that one for future restores. If you think a bad account existed before you updated, ask for help before restoring an older copy.
When to call for help
Get help if you need to restore or move a site and aren't sure your backup is clean, if you see unknown admin users, or if the site acts strangely after a restore. Planning a site move? Our post on redesigning without losing Google rankings covers the other half: keeping your search traffic safe. And if you want backups to run and get checked automatically, our guide on where to start with automation is a good first step.
For everything else fixed this month, see our October 2026 security roundup.
How Social Buzz can help
We set up safe, off-site backups, keep backup plugins updated and test restores so you know they work. If you want us to check your backup setup after these fixes, see our website security service or email info@social-buzz.app.
Questions people ask
Which Duplicator versions are affected by CVE-2026-82814?
Duplicator up to and including 1.5.17 and Duplicator Pro up to and including 4.6.10. Update to the newest version; the CVE record points to the vendor's 5.0.0 changelog for the fix.
Which Backuply version fixes CVE-2026-93953?
Backuply 1.5.9. All versions up to and including 1.5.8 are affected, according to Patchstack.
Are my old backups safe after I update the plugin?
Updating the plugin protects new backups and restores. Backups made with an old version were made the old way, so it is safest to make a fresh backup after updating and use that one going forward.
Do I need a backup plugin at all?
You need backups. They can come from a plugin or from your host. Whatever you use, keep it updated and test a restore now and then.
Patch, harden and watch your PHP and WordPress site.
Old PHP versions, outdated WordPress plugins and weak logins are common ways websites get broken into. We update and patch your site, close common gaps, and watch it so problems are caught early.
See how we help →