Someone planted backdoors in dozens of WordPress plug-ins used in thousands of websites