Attackers can abuse a loophole in the Wordpress plug-in WPForms to reverse payments, for example. Six million websites use the plug-in.