[wlug] Researchers find backdoor lurking in WordPress plugin used by schools