far, the vulnerable sites under these new attacks are those running WordPress plugins such as Insert PHP and Exec-PHP, which allow visitors to customize posts by inserting PHP-based code directly into them.