The cloaking injection malware has been present for at least 3 months: https://plugins.trac.wordpress.org/changeset/1428395/404-to-301 https://plugins.trac.word

The cloaking injection malware has been present for at least 3 months: https://plugins.trac.wordpress.org/changeset/1428395/404-to-301 https://plugins.trac.wordpress.org/changeset/1428395/404-to-... and apparently undergone several revisions for the bot-checking/cloaking. As I see it, there are only a few explanations for what's going on: 1. The author added the malware on purpose (and probably should be banned from publishing plugins on wordpress.org) 2. The author had his partner add the malware but didn't understand the code (which, if he couldn't spot the malwareness of the the obvious content replacement hooks or the eleet "?v=1337" URLs, means he probably should also be banned from publishing plugins on wordpress.org) 3. The author rented out his wordpress.org plugin author account and didn't pay attention to what it was used for (which means he probably should also be banned from having a wordpress.org plugin publisher account) Odd that the wordpress.org staff appears to believe this multi month adventure was "a mistake".