Massive botnet chews through 20,000 WordPress sites

Attackers have infected 20,000 WordPress sites by brute-forcing administrator usernames and passwords.