Over 100,000 WordPress sites have been infected by vulnerable third-party plug-in that many may not even realise they are running