exploit possibility?

Just half an hour after I installed this plugin, my site got defaced + they sql injected my admin account (changed user details).

Is it possibly caused by exploit that has not been found in this plugin?

http://ww.wp.xz.cn/extend/plugins/woocommerce-delivery-notes/