Bad actors are abusing leaked and compromised credentials to install the fake core-stab plugin and other items on WordPress sites.