A critical flaw in a popular WordPress plugin puts over 20,000 websites at risk of phishing attacks and code injection.