WordPress auto-update server had flaw allowing anyone to add anything to websites worldwide • The Register

http://www.theregister.co.uk/2016/11/23/wordpress_auto_update_flaw/