Administrators are being urged to patch a critical pre-authentication RCE vulnerability in WordPress that threatens millions of websites and which can lead to a full takeover by attackers.