Over 5,000 WordPress sites caught in WP3.XYZ malware attack