Active account holders had file transfer database usernames and passwords exposed and, for some, SSL keys as well.

The bug appears in WordPress instances prior to version 4.9.9 and was exploitable for as long as six years, the RIPS Technologies researchers said.

The plugin Simple Social Buttons allows Wordpress users to distribute content on social media platforms. The flaw was discovered by a security developer at WebARX.

The makers of the WPML plugin said they're taking legal action against the attacker.

The flaw has been patched in the privacy-focused plugin WP GDPR Compliance, which has more than 100,000 downloads.