A critical vulnerability found in a WordPress plug-in that has been downloaded over 1.7 million times allows potential attackers to take complete control of blogs that use it. The flaw is located in the MailPoet Newsletters plug in, previously known as wysija-newsletters, and was discovered by researchers from Web security firm Sucuri. The bug was the result of the developers wrongly assuming that the “admin_init” hook in WordPress is only triggered when an administrator visits pages from the administration panel.”]