Suspicious Files

1. When someone sends a POST request with a variable php and a base 64 encoded value that is PHP code after decoding it, that PHP code will run with the permissions of all your own PHP files. The attacker can read all database content, create new users, upload files …

2. The second code does the same, just without encoding the PHP.

Both injections are rather primitive; they look almost as if they should be found to make you feel safe when you remove them.

It is very likely that these snippets are not the only problems. The attacker has used his new site probably and added some files. Read Verifying that I have fully removed a WordPress hack? and follow all suggestions mentioned there.

Find the back door. Read your log files if they aren’t already compromised.