A critical flaw in a WordPress add-on was recently patched, which allows crooks to add a rogue admin account to the site.
Benign add-ons can be weaponized with malicious updates after gaining user trust.