A security flaw in the Ally WordPress plugin used on more than 400,000 sites could allow attackers to extract sensitive data ...