A critical file-upload flaw in RealHomes CRM plugin exposed 30,000+ WordPress sites to remote code execution. Patches are out, but slow updates leave many vulnerable amid active scans.