The old plugin manager is still available in confluence if you know the URL (../admin/viewplugins.action ) it looks quite terrible and given it is almost an unknown feature most of the current Confluence Team would not know to fix it if there are security problems with it. It was kept when we put UPM 1 in back in Confluence 3.4 (I think it was) as a fallback in case the newfangled UPM didn't work. UPM has now proven itself and thus the old and probably insecure plugin manager should be removed permanently not just hidden.