Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

duplicator · by smub · wordpress.org ↗ · SVN ↗
Acquired by Awesome Motive on 2023-01-05. Previously owned by Snap Creek. New committers from that team's naming convention are expected and will not fire takeover events. source ↗
Active installs
1M+
Current version
5.0.4
Added
2011-06-07
Last updated
2026-09-18 (2d ago)
First seen by beacon
5mo ago
Total downloads

Statistics

2024-06-17 → 2026-09-10 · 816 days
Downloads today
58,828
7-day total 440,052
Week over week
▲ +35%
vs prior 7 days
30-day trend
declining
▲ +411% MoM
Abandonment
○○○○○
healthy
Downloads/day Linear trend
328k246k164k82k02024-062024-102025-032025-072025-122026-04
328k246k164k82k02026-062026-062026-072026-072026-082026-08
328k246k164k82k02026-082026-082026-082026-082026-092026-09

Active versions

1.55.0
1.5 · 71.3%5.0 · 15.9%other · 7.3%1.4 · 5.6%

Ratings

5★
4,689
4★
63
3★
21
2★
22
1★
139

Support: 3/7 resolved

Alerts (1)

Medium code_scan_delta 2026-09-09 19:30:23 (11d ago)
Slugduplicator
Previous version1.5.17
Current version5.0.0
New findings
PatternKindFileLineSnippetConfidence
gzinflatebuiltinvendor-prefixed/rmccue/requests/src/Requests.php831$decoded = @gzinflate($data);medium
gzinflatebuiltinvendor-prefixed/rmccue/requests/src/Requests.php920$decompressed = @gzinflate(substr($gz_data, 2));medium
gzinflatebuiltinvendor-prefixed/rmccue/requests/src/Requests.php944$decompressed = @gzinflate(substr($gz_data, 30 + $first_file_start));medium
gzinflatebuiltinvendor-prefixed/rmccue/requests/src/Requests.php951$decompressed = @gzinflate($gz_data);medium
gzinflatebuiltinvendor-prefixed/rmccue/requests/src/Requests.php957$decompressed = @gzinflate(substr($gz_data, 2));medium
base64_decodebuiltinaddons/litebase/src/Settings/ConnectController.php258$cipherBin = base64_decode($encrypted, true);medium
base64_decodebuiltinaddons/litelegacyaddon/src/Models/LegacyBackupMigration.php337if (!is_string($installer['OptsSecurePass']) || ($password = base64_decode($installer['OptsSecurePass'], true)) === false) {medium
base64_decodebuiltinsrc/Package/Create/PackInstaller.php182$this->passowrd = base64_decode($this->OptsSecurePass);medium
base64_decodebuiltinsrc/Utils/Crypt/CryptBlowfish.php260$decoded = base64_decode($string);medium
base64_decodebuiltinsrc/Utils/Crypt/CryptBlowfish.php293$decoded = base64_decode($string);medium
base64_decodebuiltinsrc/Libs/Snap/SnapServer.php290$decoded = base64_decode($parts[1], true);medium
gzinflatebuiltinsrc/Libs/DupArchive/Headers/DupArchiveGlobHeader.php166if (($result = @gzinflate($result)) === false) {medium
base64_decodebuiltininstaller/dup-installer/api/class.cpnl.ctrl.php78$creds = explode(",", base64_decode($token));medium
New finding count13
View raw JSON
{
    "slug": "duplicator",
    "previous_version": "1.5.17",
    "current_version": "5.0.0",
    "new_findings": [
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "vendor-prefixed/rmccue/requests/src/Requests.php",
            "line": 831,
            "snippet": "$decoded = @gzinflate($data);",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "vendor-prefixed/rmccue/requests/src/Requests.php",
            "line": 920,
            "snippet": "$decompressed = @gzinflate(substr($gz_data, 2));",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "vendor-prefixed/rmccue/requests/src/Requests.php",
            "line": 944,
            "snippet": "$decompressed = @gzinflate(substr($gz_data, 30 + $first_file_start));",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "vendor-prefixed/rmccue/requests/src/Requests.php",
            "line": 951,
            "snippet": "$decompressed = @gzinflate($gz_data);",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "vendor-prefixed/rmccue/requests/src/Requests.php",
            "line": 957,
            "snippet": "$decompressed = @gzinflate(substr($gz_data, 2));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "addons/litebase/src/Settings/ConnectController.php",
            "line": 258,
            "snippet": "$cipherBin = base64_decode($encrypted, true);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "addons/litelegacyaddon/src/Models/LegacyBackupMigration.php",
            "line": 337,
            "snippet": "if (!is_string($installer['OptsSecurePass']) || ($password = base64_decode($installer['OptsSecurePass'], true)) === false) {",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Package/Create/PackInstaller.php",
            "line": 182,
            "snippet": "$this->passowrd = base64_decode($this->OptsSecurePass);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Utils/Crypt/CryptBlowfish.php",
            "line": 260,
            "snippet": "$decoded = base64_decode($string);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Utils/Crypt/CryptBlowfish.php",
            "line": 293,
            "snippet": "$decoded = base64_decode($string);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Libs/Snap/SnapServer.php",
            "line": 290,
            "snippet": "$decoded = base64_decode($parts[1], true);",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "src/Libs/DupArchive/Headers/DupArchiveGlobHeader.php",
            "line": 166,
            "snippet": "if (($result = @gzinflate($result)) === false) {",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "installer/dup-installer/api/class.cpnl.ctrl.php",
            "line": 78,
            "snippet": "$creds = explode(\",\", base64_decode($token));",
            "confidence": "medium"
        }
    ],
    "new_finding_count": 13
}
Show 3 resolved alerts
Critical code_scan_match Resolved · code_scan_fp_class_genre_encoding 2026-05-05 11:18:53 (4mo ago)
Slugduplicator
Finding count7
Findings
PatternKindFileLineSnippetConfidence
base64_decodebuiltinclasses/utilities/class.u.php476return base64_decode($string);medium
base64_decodebuiltinsrc/Ajax/ServicesEducation.php217$encrypted = base64_decode($encryptedData);medium
gzinflatebuiltinsrc/Libs/DupArchive/Headers/DupArchiveReaderGlobHeader.php86return ($isCompressed ? gzinflate($globContents) : $globContents);medium
gzinflatebuiltinsrc/Libs/DupArchive/DupArchiveExpandBasicEngine.php252$globContents = gzinflate($globContents);medium
serialized_admin_rolebuiltininstaller/dup-installer/classes/config/class.conf.wp.php22const ADMIN_SERIALIZED_SECURITY_STRING = 'a:1:{s:13:"administrator";b:1;}';high
base64_decodebuiltininstaller/dup-installer/classes/class.crypt.php33$string = base64_decode($string);medium
base64_decodebuiltininstaller/dup-installer/classes/utilities/class.u.php1,391$decoded = base64_decode($str, true);medium
Resolved sha61a8ed704b64de3d0352e7c5f37648612842cfdf
View raw JSON
{
    "slug": "duplicator",
    "finding_count": 7,
    "findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "classes/utilities/class.u.php",
            "line": 476,
            "snippet": "return base64_decode($string);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Ajax/ServicesEducation.php",
            "line": 217,
            "snippet": "$encrypted = base64_decode($encryptedData);",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "src/Libs/DupArchive/Headers/DupArchiveReaderGlobHeader.php",
            "line": 86,
            "snippet": "return ($isCompressed ? gzinflate($globContents) : $globContents);",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "src/Libs/DupArchive/DupArchiveExpandBasicEngine.php",
            "line": 252,
            "snippet": "$globContents = gzinflate($globContents);",
            "confidence": "medium"
        },
        {
            "pattern": "serialized_admin_role",
            "kind": "builtin",
            "file": "installer/dup-installer/classes/config/class.conf.wp.php",
            "line": 22,
            "snippet": "const ADMIN_SERIALIZED_SECURITY_STRING = 'a:1:{s:13:\"administrator\";b:1;}';",
            "confidence": "high"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "installer/dup-installer/classes/class.crypt.php",
            "line": 33,
            "snippet": "$string = base64_decode($string);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "installer/dup-installer/classes/utilities/class.u.php",
            "line": 1391,
            "snippet": "$decoded = base64_decode($str, true);",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "61a8ed704b64de3d0352e7c5f37648612842cfdf"
}
Critical code_pattern Resolved · false_positive_defensive_string_check 2026-04-30 15:25:27 (4mo ago)
Slugduplicator
Patternserialized_admin_role
Kindbuiltin
Version1.5.16
Hit count1
First hit
File
installer/dup-installer/classes/config/class.conf.wp.php
Line
22
Snippet
const ADMIN_SERIALIZED_SECURITY_STRING = 'a:1:{s:13:"administrator";b:1;}';
Explanationplugin source contains `s:13:"administrator"` — the PHP-serialized representation of the `administrator` role meta value. Used to bypass `wp_insert_user()` by writing directly to `wp_usermeta` with a hand-crafted capabilities string. Near-zero FP because legit code uses `WP_User::set_role()` instead of building the serialized form by hand.
View raw JSON
{
    "slug": "duplicator",
    "pattern": "serialized_admin_role",
    "kind": "builtin",
    "version": "1.5.16",
    "hit_count": 1,
    "first_hit": {
        "file": "installer/dup-installer/classes/config/class.conf.wp.php",
        "line": 22,
        "snippet": "const ADMIN_SERIALIZED_SECURITY_STRING = 'a:1:{s:13:\"administrator\";b:1;}';"
    },
    "explanation": "plugin source contains `s:13:\"administrator\"` \u2014 the PHP-serialized representation of the `administrator` role meta value. Used to bypass `wp_insert_user()` by writing directly to `wp_usermeta` with a hand-crafted capabilities string. Near-zero FP because legit code uses `WP_User::set_role()` instead of building the serialized form by hand."
}
Critical code_scan_delta Resolved · false_positive_cdn_known_good 2026-04-30 05:53:23 (4mo ago)
Slugduplicator
Previous version1.5.16
Current version1.5.16
New findings
PatternKindFileLineSnippetConfidence
serialized_admin_rolebuiltininstaller/dup-installer/classes/config/class.conf.wp.php22const ADMIN_SERIALIZED_SECURITY_STRING = 'a:1:{s:13:"administrator";b:1;}';high
New finding count1
View raw JSON
{
    "slug": "duplicator",
    "previous_version": "1.5.16",
    "current_version": "1.5.16",
    "new_findings": [
        {
            "pattern": "serialized_admin_role",
            "kind": "builtin",
            "file": "installer/dup-installer/classes/config/class.conf.wp.php",
            "line": 22,
            "snippet": "const ADMIN_SERIALIZED_SECURITY_STRING = 'a:1:{s:13:\"administrator\";b:1;}';",
            "confidence": "high"
        }
    ],
    "new_finding_count": 1
}

SVN committers (5)

Accounts with actual commit access to duplicator on plugins.svn.wordpress.org, reconstructed from svn log. This is the list that matters for ownership changes — not the readme contributors.

Committer Member since Commits First commit Latest commit
Cory Lamle 2011-02-24 1,198 2011-06-07 · r394218 2022-11-16 · r2819379
andreamk 2011-02-24 58 2023-11-16 · r2997269 2026-09-08 · r3687144
SeedProd 2012-01-31 52 2022-12-21 · r2837638 2024-06-04 · r3097478
bobriley 2013-03-07 14 2016-08-09 · r1471096 2022-06-27 · r2748774
plugin-master 2007-03-09 1 2011-05-18 · r386171 2011-05-18 · r386171

Readme contributors (3)

Names the plugin's readme declares as contributors. A soft signal — anyone can be listed. The SVN access column is the ground-truth cross-reference: does this contributor actually commit code?

Contributor Member since SVN access Status
andreamk 2011-02-24 58 commits Active
SeedProd 2012-01-31 52 commits Active
Syed Balkhi 2008-06-22 Active

Versions (100 most recent)

Version Released Download
5.0.1 zip
5.0.2 zip
5.0.0 zip
1.5.17 zip
1.5.16.1 2026-05-22 · 4mo ago zip
1.5.15 2026-03-18 · 6mo ago zip
1.5.16 2026-03-18 · 6mo ago zip
1.5.14 2025-12-10 · 9mo ago zip
1.5.13.3 2025-09-12 · 1y ago zip
1.5.13.2 2025-09-03 · 1y ago zip
1.5.13.1 2025-08-12 · 1y ago zip
1.5.13 2025-07-15 · 1y ago zip
1.5.12 2025-05-27 · 1y ago zip
1.5.11.2 2024-11-21 · 1y ago zip
1.5.11.1 2024-10-09 · 1y ago zip
1.5.11 2024-09-24 · 1y ago zip
1.5.10.2 2024-08-06 · 2y ago zip
1.5.10.1 2024-07-18 · 2y ago zip
1.5.10 2024-06-27 · 2y ago zip
1.5.9 2024-06-04 · 2y ago zip
1.5.8.1 2024-02-06 · 2y ago zip
1.5.8 2024-01-10 · 2y ago zip
1.5.7.1 2023-11-16 · 2y ago zip
1.5.7 2023-11-08 · 2y ago zip
1.5.6.1 2023-10-31 · 2y ago zip
1.5.6 2023-09-19 · 3y ago zip
1.5.5.1 2023-07-20 · 3y ago zip
1.5.5 2023-06-22 · 3y ago zip
1.5.4 2023-05-08 · 3y ago zip
1.5.3.1 2023-03-31 · 3y ago zip
1.5.3 2023-03-16 · 3y ago zip
1.5.2.1 2023-02-01 · 3y ago zip
1.5.2 2023-01-26 · 3y ago zip
1.5.1 2022-12-21 · 3y ago zip
1.5.0 2022-10-31 · 3y ago zip
1.4.7.2 2022-08-15 · 4y ago zip
1.4.7.1 2022-08-03 · 4y ago zip
1.4.7 2022-06-27 · 4y ago zip
1.4.6 2022-05-25 · 4y ago zip
1.4.5 2022-04-13 · 4y ago zip
1.4.4 2022-02-01 · 4y ago zip
1.4.3 2021-09-08 · 5y ago zip
1.4.2 2021-07-28 · 5y ago zip
1.4.1 2021-05-26 · 5y ago zip
1.4.0 2021-03-17 · 5y ago zip
1.3.40.1 2020-12-15 · 5y ago zip
1.3.40 2020-12-07 · 5y ago zip
1.3.38 2020-10-02 · 5y ago zip
1.3.36 2020-08-12 · 6y ago zip
1.3.34 2020-05-16 · 6y ago zip
1.3.32 2020-05-05 · 6y ago zip
1.3.30 2020-04-20 · 6y ago zip
1.3.28 2020-02-12 · 6y ago zip
1.3.26 2020-02-08 · 6y ago zip
1.3.24 2019-11-15 · 6y ago zip
1.3.22 2019-09-12 · 7y ago zip
1.3.20 2019-08-30 · 7y ago zip
1.3.18 2019-07-13 · 7y ago zip
1.3.16 2019-07-07 · 7y ago zip
1.3.14 2019-05-21 · 7y ago zip
1.3.12 2019-05-02 · 7y ago zip
1.3.10 2019-03-16 · 7y ago zip
1.3.8 2019-03-05 · 7y ago zip
1.3.6 2019-02-20 · 7y ago zip
1.3.4 2019-01-16 · 7y ago zip
1.3.2 2018-12-31 · 7y ago zip
1.3.0 2018-12-17 · 7y ago zip
1.2.52 2018-12-07 · 7y ago zip
1.2.50 2018-10-18 · 7y ago zip
1.2.48 2018-09-25 · 7y ago zip
1.2.46 2018-09-20 · 8y ago zip
1.2.44 2018-09-14 · 8y ago zip
1.2.42 2018-08-24 · 8y ago zip
1.2.40 2018-06-06 · 8y ago zip
1.2.38 2018-06-06 · 8y ago zip
1.2.36 2018-04-25 · 8y ago zip
1.2.34 2018-03-01 · 8y ago zip
1.2.32 2018-01-10 · 8y ago zip
1.2.30 2017-11-23 · 8y ago zip
1.2.28 2017-11-05 · 8y ago zip
1.2.26 2017-10-08 · 8y ago zip
1.2.24 2017-09-09 · 9y ago zip
1.2.22 2017-09-03 · 9y ago zip
1.2.20 2017-08-26 · 9y ago zip
1.2.18 2017-08-09 · 9y ago zip
1.2.16 2017-07-29 · 9y ago zip
1.2.14 2017-07-25 · 9y ago zip
1.2.12 2017-07-21 · 9y ago zip
1.2.10 2017-07-11 · 9y ago zip
1.2.8 2017-06-10 · 9y ago zip
1.2.6 2017-05-04 · 9y ago zip
1.2.4 2017-04-08 · 9y ago zip
1.2.2 2017-04-04 · 9y ago zip
1.2.0 2017-03-24 · 9y ago zip
1.1.34 2017-02-25 · 9y ago zip
1.1.32 2017-02-18 · 9y ago zip
1.1.30 2017-02-02 · 9y ago zip
1.1.28 2017-01-19 · 9y ago zip
1.1.26 2017-01-05 · 9y ago zip
1.1.24 2016-11-29 · 9y ago zip