Skip to content
StaleWP

Replace now Radar no. 03 · Quiet

BackUpWordPress

By Tom Willmot

What it does: Runs automatic backups of a WordPress site.

Why it’s listed: Backups have to work on the day you need them. This plugin has had no update for two and a half years and is tested only up to WordPress 6.5. Three public advisories are on record, all listed as fixed. Whichever plugin you use, restore one backup to a test site so you know it works.

Update ·

Version 3.15 was released on 5 November 2026, the first update since April 2024. Its changelog lists security fixes, including one that stopped logged-in users with low-level accounts from deleting files in the backups folder. No public advisory had been listed for that issue when we published Edition 1. The plugin is now tested with WordPress 7.1. If you keep it, update to 3.15.

This update came after the edition was published. The placement below is from the edition.

View on WordPress.org ↗ Its admin notices on dismissed.fyi ↗ Checked Reviewed by Abhishek Deshpande

Active installs
80k+
Last updated
2024-04-24
Tested up to
6.5.14
Rating
4.7 / 5 (1,373)
Version
3.14
Maintainers
12

Is BackUpWordPress still maintained?

It has gone over two years without an update, and it has a second warning sign: handles backups.

Quiet: No update for over a year.

Placements are our opinion, based on public evidence. Risk here means a plugin may not get a fix if a problem appears. It doesn’t mean we found a flaw, unless we show an advisory. Going quiet alone never puts a plugin in Replace now.

Updates No release since 2024-04-24. That was 2 yr 6 mo before our check. WordPress.org plugin directory · checked 2026-10-31
Compatibility Tested up to WordPress 6.5.14. WordPress 7.1.4 was current on 2026-10-31. WordPress.org plugin directory · checked 2026-10-31
Security 3 public advisories on record. Details are below. wpvulnerability.net · checked 2026-10-31
Reviews The latest 10 reviews average 4.4 stars, against 4.7 overall. 2 of them gave 1 or 2 stars. Newest activity: 2026-01-21. We see no negative trend. WordPress.org reviews · checked 2026-10-31
Maintainers 12 listed contributors. 0 of 1 recent support threads are marked resolved. WordPress.org plugin directory · checked 2026-10-31
Usage 3,368 downloads in the last 30 days, including updates. 66.71% of sites run version 3.14. WordPress.org stats · checked 2026-10-31

What to do next

  1. Back up the site, and use a staging copy for any change.
  2. Try one of the alternatives below.
  3. Test a restore before you remove this plugin.

If it works today, no need to panic, but don’t leave this for long.

Recommended alternatives to BackUpWordPress

UpdraftPlus ↗

Scheduled backups with remote storage.

4M+ installs · 4.8 stars · Updated 2026-10-26 · Tested 7.1.4

WPvivid ↗

Backup, migration and staging.

900k+ installs · 4.9 stars · Updated 2026-10-30 · Tested 7.1.4

Duplicator ↗

Backups and full-site copies.

1M+ installs · 4.9 stars · Updated 2026-10-27 · Tested 7.1.4

Each listed plugin was updated in the last six months, is tested with WordPress 7.0 or newer, and had no open advisory in WPVulnerability when we checked. We have not tried them ourselves. No one pays to appear here.

Security record

AdvisorySeverityFixed in
CVE-2024-3034 ↗
Path traversal 		Low (2.7) 3.14
CVE-2022-4931 ↗
Access control 		Medium (4.3) 3.13
CVE-2007-5800 ↗
Remote file inclusion 		Not scored 0.4.3

wpvulnerability.net · checked 2026-10-31

A listed advisory does not mean the current version is exploitable.

Latest reviews

Dates show last activity. Titles are written by WordPress.org users.

Also on this radar: Database and backups

No one can pay to appear on the radar or to change a placement. How we stay independent

Something wrong, or updated since we checked? Suggest a correction

StaleWP Newsletter

What changed in the plugin directory, twice a month. Free, unsubscribe anytime.

See how we handle your email on our Legal page.