BackWPup 5.7 is best understood as a release line rather than one isolated update. Across the 5.7.x releases, the plugin added an AI-assisted management interface, addressed compatibility issues, introduced detection for stale restore files and fixed a Cross-Site Scripting vulnerability on the Restore page. For site owners, the practical task is therefore broader than clicking an update button: the installation should be reviewed, backup jobs should be tested and the restore workflow should be checked in a controlled environment.
This guide focuses on the operational questions that matter after updating BackWPup. It explains what changed, how to respond to the documented Restore-page fix, how to review temporary restore artifacts, and what MCP support means for agencies. It also provides a WooCommerce validation process and an acceptance checklist for client websites. The aim is not to claim universal compatibility or guaranteed recovery, but to help teams create a repeatable WordPress backup security and restore-audit workflow.
BackWPup 5.7 at a glance: what changed and when
BackWPup 5.7.0, released on June 8, 2026, introduced MCP support for compatible AI assistants. The documented operations include managing backup jobs, monitoring progress, cancelling jobs and accessing logs. This makes MCP an administrative interface for backup work rather than only a way to display information. Its value depends on how the connection is authenticated, which assistant is used and how the resulting activity is reviewed.
Later releases added practical corrections. Version 5.7.3 introduced the backwpup_mcp_server_enabled filter, corrected backup-history file sizes across storage destinations, addressed a WooCommerce issue that could generate log errors and fixed PHP 8.1+ compatibility issues affecting MCP operations. These are documented fixes, not a universal compatibility statement for every WooCommerce version, hosting configuration or MCP client.
Version 5.7.4 added a security notice that detects stale restore files and permits one-click deletion. It also states that restore working directories are automatically cleaned after successful restores. Version 5.7.5, released on July 21, 2026, fixed an XSS vulnerability on the Restore page, along with an incorrect backup-aborted notice, a Backup Now page freeze and an admin-notice dismissal issue. The available changelog does not provide severity, exploit conditions, affected-version ranges, a CVSS score or information about observed exploitation.
Security response after the 5.7.5 Restore-page fix
Site owners should update BackWPup through the normal WordPress update process to the current documented 5.7.x release and then confirm which version is installed and active. Do not assume that an update completed simply because the administration screen appeared to refresh. The version check is a small but important part of an audit record, particularly when an agency manages several client installations.
The changelog identifies the Restore-page XSS fix, but it does not explain the vulnerability’s technical scope or establish that other versions contain the same correction. Avoid filling those gaps with assumptions. After updating, review who can access the Restore page and perform a controlled Restore-page smoke test. Use a known archive and verify the target environment before starting, because restore actions can overwrite the website.
A manual backup is appropriate before major plugin, theme or WordPress Core changes. The backup should be visible in the relevant history, have a readable status and be available at its intended storage destination before further testing begins. Teams looking for additional tools for the wider site update and administration workflow can browse WordPress plugins, while keeping BackWPup’s security correction and testing process separate from any product-category decision.
Stale restore files: what they are and how to audit them
Stale restore files are temporary restore data that remains after it is no longer needed for an active restore or an investigation. The documented temporary location is wp-content/uploads/backwpup-restore. It can contain uploaded archives, extracted files, restore.log, restore.dat, and the upload and extract directories. The documented workflow also identifies an .htaccess file intended to prevent direct access.
BackWPup 5.7.4 adds a security notice to detect stale restore files and provides one-click deletion. Successful restores are designed to clean their restore working directories automatically, so a notice may indicate that temporary data remains and deserves review. It should not be treated as proof that the files are dangerous in every situation, nor should it be interpreted as a universal retention rule for every hosting environment.
A cautious audit follows a clear order:
- Review the BackWPup notice and identify the restore-related data it reports.
- Confirm that no restore operation is currently running.
- Check the restore log and backup history if a restore was recently attempted.
- Confirm that the files are not needed for troubleshooting, recovery or an active investigation.
- Verify that a separate, valid backup archive is available.
- Use the documented deletion action when removal is appropriate.
Deleting temporary restore data is not a replacement for maintaining backup archives. The decision should be based on the current restore state and the team’s recovery records, not on an invented number of days or a blanket rule.
MCP backups for agencies and technical teams
MCP support allows compatible AI assistants to interact with BackWPup backup administration. The documented operations include listing configured jobs and storage destinations, starting or cancelling backup jobs, retrieving recent backup history and reading backup logs. In an agency workflow, this can make routine status checks and job actions easier to coordinate, but the assistant should not be treated as an autonomous or risk-free backup system.
MCP arrived in BackWPup 5.7.0 and received controls and compatibility corrections in 5.7.3. The documented backwpup_mcp_server_enabled filter provides a way to disable MCP. The official material also describes authentication through WordPress credentials and an Application Password. Because this is an administrative connection, agencies should use a dedicated, appropriately scoped Application Password and limit access to trusted assistants.
Access control should be paired with activity review. After an AI-triggered operation, check that the intended job was started or cancelled, that the expected storage destination was used, and that the history and logs show the anticipated result. Do not assume that every AI assistant, MCP client or hosting environment exposes identical controls. If a client does not need AI-assisted administration, leaving MCP disabled is a reasonable configuration choice based on the site’s operational requirements.
WooCommerce post-update validation checklist
BackWPup 5.7.3 addressed a WooCommerce compatibility issue that could generate log errors. The available research does not identify every affected WooCommerce version, hosting configuration or transaction scenario, so the release note should be treated as a reason to test rather than as a universal compatibility guarantee.
After updating, run a backup using the job intended for the store. Confirm that the job completes successfully, inspect the logs for errors and verify that the archive is present at the intended storage destination. Review the backup-history entry, including its creation information and storage location. A completed job with an unreadable log or missing archive should not be treated as an accepted result.
Next, conduct a controlled restoration test in staging or another environment selected for recovery validation. Verify the archive and target before beginning, since restoration can overwrite the website. Once the test site is restored, check the storefront, products, orders, customer accounts and checkout-related functionality in that environment. The test should also confirm that the restore workflow leaves no unexpected temporary data and that relevant logs can be reviewed afterward.
Record the BackWPup version, test environment, archive, storage destination, completion result and log observations. Store owners who need to compare related extensions can explore WooCommerce plugins, but any product choice should remain separate from the specific BackWPup validation evidence collected for the site.
Agency backup-and-restore acceptance checklist
Agencies can turn the 5.7.x update into a repeatable acceptance process rather than relying on a successful installation screen. Begin by recording the installed BackWPup version and the environment under test. Before a major plugin, theme or WordPress Core change, run a manual backup. Confirm that the archive exists, the intended data is included, the storage destination is correct and the backup-history entry has a readable log.
After installation or updating, review the administration area for restore notices and stale restore files. If a restoration is tested, use a known archive in a controlled environment and verify the target before proceeding. Review the result and confirm that temporary restore data is cleaned after a successful restore. If temporary files remain, use the documented audit and deletion process only after confirming that no active restore or investigation depends on them.
For a client handover, record the job status, archive availability, storage destination, restore result and any unresolved log observations. If MCP is enabled, document the Application Password access, confirm that the intended assistant can perform only the required workflow and review AI-triggered jobs, cancellations, history and logs. The checklist verifies an installation and workflow; it is not a guarantee that every future restoration will succeed.
A membership plan may also be relevant to agencies comparing access to multiple website tools, so teams can compare membership plans alongside their project requirements. Keep the operational record specific to each site rather than assuming that one tested configuration applies to every client.
BackWPup 5.7 should be approached as an update-and-audit task. Move to the current documented 5.7.x release, confirm the installed version and review the Restore page after updating. Check for stale restore files, but delete them only when no restore is active, the data is no longer needed and a separate valid archive is available. For WooCommerce, verify backup completion, logs, archive availability and a controlled restoration result instead of relying on the release note alone. MCP can streamline administrative actions for compatible assistants, but it requires deliberate authentication, restricted access and review of activity. Explore our WordPress plugins, WooCommerce extensions, themes and membership plans to find the right tools for your website.