WordPress plugin can be exploited to run PHP commands on the server by posting a comment that contains a malicious payload.