Malicious updates available from WordPress.org create attacker-controlled admin account.