A weakness in the WordPress File Manager plugin has been exploited in the wild, resulting in website hijacking.