I'm guessing an attacker would have to look for the vulnerability in a specific plugin - correct? For example, they'd have to be looking for it in Jetpack specifically. So the more popular the plugin, the bigger the risk?