[Plugin: CSV Importer] WARNING!!! iFrame Injection issue with CSV plugin

BE VERY CAREFUL.. While the plugin works fine. If you leave the plugin on your WP server it has security flaw allowing bots to inject iframe code.

It inserts the code in index.php in WordPress and it’s base64 encoded.

When you are infected it looks like this:

eval code moderated.]

and you will see a small 1px by 1px dot before the HTML tag of your site/template when viewed in browser.

This is what the code actually looks like when decoded:
http://pastebin.com/K1MKqwNk

The reason why I know it’s CSV plugin is because this is a fresh WordPress 3.2.1 installation without any plugins. As soon as I installed CSV plugin the site/WP installation was compromised and iFrame injection happened to the index.php

http://ww.wp.xz.cn/extend/plugins/csv-importer/