Critical WordPress update fixes zero-day flaw unnoticed