Known vulnerabilities in WebToffee WP Backup and Migration

Easily backup, restore, or migrate. Supports one-click backup and scheduled backup. Backup selected content to Amazon S3, Google Drive, FTP/SFTP, etc.

9Reported vulnerabilities

7.5Highest CVSS score

1.5.9Latest version

5,000+Active installs

What to do now

Update WebToffee WP Backup and Migration to 1.6.1 or later. 9 of these have a fixed version available. Updating resolves them.

Plugin last updated: March 31, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2023-5738	Medium 5.4	0.4%	Before 1.4.4	`1.4.4`	November 27, 2023
CVE-2023-5737	Medium 4.3	0.5%	Before 1.4.4	`1.4.4`	November 27, 2023
CVE-2026-97197	High 7.5	0.3%	1.6.0 and earlier	`1.6.1`	September 30, 2026
CVE-2024-31254	High 7.5	0.5%	Before 1.4.8	`1.4.8`	April 10, 2024
CVE-2025-24651	Medium 5.9	0.4%	0 to 1.5.3 (inclusive)	`1.5.4`	April 17, 2025
CVE-2023-45636	Medium 5.4	0.5%	0 to 1.4.1 (inclusive)	`1.4.2`	January 2, 2025
CVE-2023-52183	Medium 5.4	0.4%	1.4.3 and earlier	`1.4.4`	June 11, 2024
CVE-2023-33928	Medium 4.3	0.5%	1.4.0 and earlier	`1.4.1`	December 13, 2024
CVE-2024-3546	Medium 4.3	0.5%	1.4.8 and earlier	`1.4.9`	April 22, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.