thumbnail Hackers target WordPress calendar plugin used by 150,000 sites