Critical Wordpress plugin bug lets hackers take over hosting account