Hackers exploit logged-in WordPress admins' browser sessions to install hidden PHP backdoors without stealing passwords.