A critical security patch for the popular Jetpack WordPress plugin is being forcefully installed on 5 million sites by Automattic, the parent company behind WordPress.