Millions of WordPress sites targeted using major security flaw