Over 10,000 WordPress sites vulnerable to exploit