A critical WordPress plugin flaw allows threat actors to run arbitrary PHP commands, potentially taking over entire websites.