Two months ago one of our Wordpress sites was infested through and through. This was at the same time I started working at this company. Our main platform is Plone, but I guess they did some on the fly projects using Wordpress in the past. Those sites were neglected and the burden of maintenance fell on me - I don't mind though, it's entry position and I learn a lot on daily basis. I scanned the site using WordFence, wrote some clean up scripts, changed all the passwords, deleted forced admin user (yeah, it got that far), scoured through DB, tightened upload directory security ... While cleaning the site google tagged the site for malicious content (nasty big red warning). After complete clean-up I've sent request for rescan and warning flag was removed. Source of infestation was a fake plugin (no idea who or why installed it), needles to say it was deleted with the rest of infested code.
Since then business was as normal as Wordpress allows it. We're still having a lot of brute force attempts; I can imagine domain was added to some "black-hat registry", but that's ok, since passwords are mighty tight and I've set attempt limit plus consequent IP ban.
Well, today I got a notice from WordFence about infested file. My blood pressure rose like a helium filled balloon. After investigation I found out it was a single file:
And nothing else was impacted, it would seem. But I can't be sure until I know what this file was trying to achieve. Could someone take a look and maybe provide a link to resources describing how is it possible for anyone to upload this piece of ... unwanted code. Am I dealing with fake plugin again? I've cleaned everything and sealed the backdoor :(
I've changed domain to www.somedomain.com.
Sorry for the long intro, just wanted to clarify my position and dismiss assumptions about any alternative motives - seen it happen to someone else asking similar question without any background information.