Malicious WordPress Plugin Creates Hidden Admin User Backdoor

A malicious WordPress plugin named php-ini.php was discovered that conditionally created a malicious admin user on infected websites. The plugin mimicked the legitimate wpforms plugin but only included a single file.