WordPress sites under attack via zero-day in abandoned plugin