300,000 active WordPress sites could have a hidden backdoor. Hope, your site is not one of them. Hope, your site is not one of them.

BestWebSoft sold a popular Captcha WordPress plugin to an undisclosed buyer, who then modified the plugin to download and install a hidden backdoor.

While reviewing the source code of the Captcha plugin, WordFence folks found a severe backdoor that could allow the plugin author or attackers to remotely gain administrative access to WordPress websites without requiring any authentication.

For More:
https://thehackernews.com/2017/12/wordpress-security-plugin.html