Plugin bug results in attacks on millions of WordPress sites