WordPress Plug-in Has Critical Zero-Day