Zero-day in WordPress SMTP plugin abused to reset admin account passwords

A patch has been released earlier this week but many WordPress sites remained unpatched —as usual.