A severe vulnerability in the UpdraftPlus Backup & Migration Plugin lets unauthenticated attackers gain admin control on over 3 million WordPress sites.