NinjaForms WordPress plugin, actively exploited in wild, receives forced security update

Wordpress being able to force push code updates looks a lot like a botnet to me. And I'm not talking about compromised instances. What could go wrong?