A popular WP plugin can be abused to take over websites and thousands of sites are vulnerable.