Web Plura Backup & Restore – Local Backups, Restore & Recovery

Web Plura Backup & Restore – Local Backups, Restore & Recovery has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it remains unpatched as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.

The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 1 of the records (100%).

The one issue recorded for Web Plura Backup & Restore – Local Backups, Restore & Recovery has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2026.

All of these findings were reported by Ananda Dhakal. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all Web Plura Backup & Restore – Local Backups, Restore & Recovery vulnerabilities before they are exploited.

Most severe open issueCVSS 5.3CVE-2026-42630

Web Plura Backup & Restore – Local Backups, Restore & Recovery <= 0.2.25 - Unauthenticated Information Exposure

Read the full analysis

Vulnerability Records

1 records
Web Plura Backup & Restore – Local Backups, Restore & Recovery banner
Latestv0.2.27

Web Plura Backup & Restore – Local Backups, Restore & Recovery

Web Plura

Author

Web Plura

0.0(0)
0/100
Last Updated
2026-10-19 (8h ago)
Active Installs
0+
Downloads
387
Requires WP
5.8+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2026-07-17 (3mo ago)

A WordPress backup is only useful if you know what it contains, where it is stored, and how restore will be reviewed before changes are applied. Site owners often need a clear local backup before a plugin update, theme change, content push, migration test, or risky maintenance window. Web Plura Backup & Restore Manager is a local WordPress backup and restore plugin for site owners, developers, and agencies who want deliberate backup jobs, restore review, and restore readiness inside wp-admin. Use it when you need a manual WordPress backup before updates, a database-only backup before content work, a files-only backup before theme/plugin changes, or a local restore workflow with checkpoints and confirmation. The plugin focuses on controlled local backups rather than automatic offsite backup storage. WordPress backup problems it helps review Backup & Restore Manager is built for local readiness checks such as: Manual WordPress backup before plugin, theme, or core updates. Full-site backup when files and database should be captured together. Database-only backup before content, order, or settings work. Files-only backup before theme, plugin, upload, or asset changes. Restore-point review, replacement confirmation, resumable job progress, and local backup slot validation. Free Local Mode is the default and works without any cloud connection. Free Local Mode keeps one retained local backup slot per backup type: full-site, database-only, and files-only. Each new backup of the same type replaces the previous slot only after explicit confirmation. Local backups are stored as protected plugin-native .wpbrpkg artifacts with .wpbridx metadata, and restore requires Web Plura Backup & Restore Manager rather than generic unzip/import steps. Jobs page can resume failed Free Local Mode jobs from their last saved checkpoint. Cloud-managed failed jobs remain governed by cloud workflow authority. The free WordPress.org plugin is local-only and gives site owners deliberate local backup and restore workflows with checkpoints and job history. Cloud operations, account validation, hosted package downloads, and advanced disaster recovery support belong to separate hosted Web Plura services. Product page: https://wplura.com/products/web-plura-backup-restore-dr Terms: https://wplura.com/terms Privacy: https://wplura.com/privacy Free Local Backup Features Manual local full-site backup. Manual local database-only backup. Manual local files-only backup. One retained local slot per backup type. Explicit confirmation before replacing a local backup slot. Local restore from plugin-created backup slots. Explicit confirmation before restore. Resumable local job runner with checkpoints. Job history and local audit events. Local backup storage visibility. Restore readiness notes. Good Fit For WordPress admins making a manual backup before plugin, theme, or core updates. Developers who want separate database-only and files-only backup choices. Agencies reviewing restore readiness before maintenance windows. Site owners who want explicit confirmation before replacing a retained local backup slot. External Services This free package does not require an external service connection for local backup and restore workflows. Optional telemetry can be enabled by a site administrator from the plugin telemetry settings. It is disabled by default and is not required for local backup and restore workflows. When enabled, the plugin may send selected categories to Web Plura at https://api.wplura.com/v1/plugin/telemetry/events: Usage analytics: plugin lifecycle, consent, and version events. Error diagnostics: sanitized plugin error category, severity, component, message code, and fingerprint. Environment diagnostics: coarse WordPress, PHP, multisite, locale, and plugin version metadata with consented events. The recipient is Web Plura. The data is used to understand plugin reliability and compatibility. The plugin does not send backup archives, database content, file contents, restore payloads, job logs, storage keys, local paths, personal records, passwords, API secrets, JWTs, authentication headers, request bodies, raw stack traces, or unrelated personal information. Consent can be withdrawn later from the plugin telemetry settings, and local backup and restore workflows continue working when telemetry is disabled or unavailable.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C