Patch this WordPress plugin bug, thousands of site owners warned