WordPress captcha plugin on 300,000 sites had a sneaky backdoor • The Register

https://www.theregister.co.uk/2017/12/20/backdoor_wordpress_captcha/