More than 100K WordPress sites compromised by malware due to plugin vulnerability