WordPress patched a zero day vulnerability in the WP Mobile Detector plugin that had been publicly attacked for close to a week.