WordpressCore Plugin

[cultro]

Has anyone else had a problem with a mysterious plugin appearing in Wordpress ?
Its called WordpressCore and says its from Wordpress.
If you look at the plugin folder it contains a file called includes.php which loads another file called crypto.txt
The crypto.txt file is a Base64 encrypted text file. The includes.php file also references a Hex key

These files were not picked up by my hostings malware scanner, but after discussions with them I deleted the file.
A short while later it reappeared.

I have been turning on and off various PRO plugins I have downloaded from here to see which one is causing this. I have had some problems with the Fluent plugins causing PHP errors, so I started with them.

I will report back if I can detect whats causing it.

Whether related or not my php version also changed from 7.4 to 7.0

I googled to see if WordpressCore plugin was a known thing, but nothing came up

So was wondering if anyone else had the same problem?

 

[guguk]

You can easily modify "from" "author" information thats no matter first of all.
You should immediately suspect such as plugins called "wordpresscore" "wpcore" etc becuase it's named on purpose.
If I were you I just backup all files (in zip) and database too and then install fresh wordpress with new database after deleting everything.