A major anti-spam plugin for WordPress carried critical vulnerabilities.Flaws allowed threat actors to install malicious plugins and execute arbitrary code remotely.The vulnerabilities have been patched, and users are advised to update their sites.The plugin, called 'Spam protection, Anti-Spam, and Firewall', is installed on over 200,000 websites.