A critical vulnerability was patched to a popular WordPress plugin: Convert Plus allowing intruders to be able to create Admin user accounts to any WordPress sites that have this plugin installed.