Many websites exposed to account takeover due to a critical vulnerability in the email delivery WordPress plugin Post SMTP.