WordPress plugin
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More security & vulnerabilities
No known unpatched vulnerabilities in 5.1.1
All 20 known vulnerabilities are fixed in the latest release. If you run an older version, update to 5.1.1 or newer.
- Critical4
- High6
- Medium10
- Low0
All Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.5 | Directory Traversal <1.3.28Update to 1.3.28CISA KEVPublic PoC | CVE-2020-11738 |
- High7.5KEVPoCDirectory Traversal
<1.3.28Update to 1.3.28
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More: common questions
Does Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More have known vulnerabilities?
Yes. VulnCrest Radar lists 20 known vulnerabilities in Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More: 4 critical, 6 high, 10 medium. None are known to affect version 5.1.1.
How do I check which version of Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More vulnerability?
CVE-2026-112244, published Nov 4, 2026: Duplicator < 5.1.0 - Unauthenticated Full Path Disclosure. Severity: Medium (CVSS 5.3).
Is any Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More vulnerability listed in CISA KEV?
Yes, 1 is listed in the CISA Known Exploited Vulnerabilities catalog. Patch immediately and review the site for signs of compromise.