I've emailed the wordpress team when i discovered hidden spam pages on my blog, they did took the plugin down, the problem is, taking it down does not solve the problem, they should provide a security warning and a clean update.