Today an exploit for BackUpWordPress has been published on http://www.milw0rm.com. It is a Remote File Inclusion Vulnerability and affects all versions of BackUpWordPress. Until I am able to release a security fix for it, please deactivate the plugin.

I am working on a security fix and will release it asap.

Thanks to iKArus and mike for the information!

— Update —

Ony WordPress installations on hosts which allow for

register_globals = on
allow_url_fopen = on

in their php.ini settings are affected. Use the Phpinfo plugin to find out if your WordPress website is at risk.