Top WordPress anti-spam plugin may actually be putting your site at risk of attack