WordPress accounted for 90 percent of all hacked CMS sites in 2018