Security Issue | Report Bugs | Forum Archive

I just recieved the following notice from my web host for two of my sites where I have the xcloner plugin installed. You may want to do a security audit on this:

It's come to our attention that your (gs) Grid-Service has been compromised and is hosting malicious files. These files are being used to relay spam and attack other servers on the Internet. This degrades your service, as well as the service of others, and is a large consumer of resources overall. While the plugin developer has not yet confirmed the presence of a vulnerability, we have noticed malicious scans targeting the 'xcloner-backup-and-restore' plugin installed at the following path:

/wp-content/plugins/xcloner-backup-and-restore/

As a result of the malicious scans, we found malicious files created on your (gs) Grid-Service through the requests made to the aforementioned plugin:

/wp-content/plugins/xcloner-backup-and-restore/language/it1bzz.php
/wp-content/plugins/xcloner-backup-and-restore/language/in8bah.php
/wp-content/plugins/xcloner-backup-and-restore/language/iha9nz.php
/wp-content/plugins/xcloner-backup-and-restore/css/a5ni84.php
/wp-content/plugins/xcloner-backup-and-restore/language/it1bzz.php
/wp-content/plugins/xcloner-backup-and-restore/language/in8bah.php
/wp-content/plugins/xcloner-backup-and-restore/language/iha9nz.php
/wp-content/plugins/xcloner-backup-and-restore/css/a5ni84.php

I have deleted your plugin folder from my sites, along with these files.