Attacks are targeting a security vulnerability in the WordPress plug-in Post SMTP. It allows unauthenticated attackers to take over instances.
What makes this now-patched plugin hole especially dangerous is the lack of authentication needed for an attack, which can give the ability to change root/admin passwords.