A new WordPress plugin named PhishWP has emerged, designed to facilitate sophisticated payment page scams targeting online shoppers. This plugin reportedly harvests credit card data and one-time passwords (OTPs) from legitimate websites. The plugin has been identified on Russian cybercrime forums, raising concerns about its potential to compromise sensitive information. Security experts are warning users to be vigilant against this new threat as it poses significant risks to online transactions.