WordPress patched a critical PHP vulnerability on its hosted services, while independent open-source installations did not receive automatic patching