Zero-day in WordPress SMTP plugin abused by two hacker groups

Hacker groups are creating backdoor admin accounts on vulnerable sites and redirecting users to tech support scams.