The plugin, installed on hundreds of thousands of sites, allows anyone to filch database info without having to be logged in.
Threatpost