Critical WordPress plugin vulnerability exposes million sites to attacks