Researchers at Georgia Institute of Technology have identified malicious plugins on tens of thousands of WordPress websites. An analysis of nightly backups of more than 400,000 unique web servers has revealed the existence of more than 47,000 malicious plugins installed on nearly 25,000 unique WordPress websites

Yes can be, If a plygin is nulled, or the site is hacked.