WordPress plugin installed on 1 million+ sites logged plaintext passwords