Backdoor discovered in dozens of WordPress plugins following corporate takeover