This top WordPress plugin had a security flaw that could let hackers hijack your site