They are exploiting security bugs in four WordPress plugins and 15 Epsilon Framework themes