A serious vulnerability in the FancyBox WordPress plugin makes it easy for a hacker to compromise any website based on the popular CMS. The security firm Sucuri investigated the flaw with the support of the experts Konstantin and Gennady Kovshenin. This enabled Joe Pardillo, the developer of the Fancybox plugin, to release a version without the flaw. The presence of a vulnerability in a WordPress plugin and the availability in the wild of the related exploit could affects thousands, maybe millions of websites.”]
Source: https://securityaffairs.co/wordpress/33368/hacking/exploiting-flaws-wordpress-plugins.html