Thousands of WordPress sites backdoored with malicious code