[Plugin: iRobots.txt SEO] Sub-directory installed WordPress issue

I installed this for a clients site- worked great at first- but some how a hacker was able to use this plugin to install a regions.com and rbc phishing files on this customers account- even with bullet proof security and Ultimate Security Checker both.

The place that manages our racks was notified by regions and removed the plugin.

just an fyi- they feel its a vulnerability in the plugins code. However since it was deleted with out us being able to check I cannot say for certain what vulnerability it was.