Malware masquerading itself as SEO plugin called WP-Base- SEO has infected reopen to 4 000 WordPress sites in the first two years according to security experts.