This is knows as Wp-vcd Malware. For full analysis you can check here.
For hardening Wordpress check here, and if you ask yourself, what should you do when your website is hacked - click here.
For removing that particular malware follow this.
More from IBM X-Force Exchange:
Malicious code injection inside a wordpress theme's functions.php and
wp-includes editing posts content.
Keep in mind that this may be updated version of malware, so I didn't go through all the source - my suggestion for you is to backup your website and database from clean backups.