A critical flaw in one of WordPress's most popular backup plugins leaves millions of sites exposed to account takeover. Here is what happened, what to check, and what to do now.