WordPress plugin suite hacked to push malware to thousands of sites