Yes. It was a Plugin Names “WP File Manager”

With this plugin, access to all files on the web server under this domain was possible. Download, upload …

Not a good feeling, how do I know that no files (e.g. archives in the “upload folder” or user data) have been downloaded ??