Note by Patchstack

A vPatch cannot be created for this due to the nature of the backdoor. Recommended steps: 1. Update to 1.0.49 (removes `more-functions.php` and its include), or replace the theme entirely; the vendor's own account shipped the backdoor for three releases. 2. Delete `wp-content/uploads/newspapers-x.php` (and any `wp-content/uploads/<theme-or-plugin-slug>.php` / `wpghost.php`), the file-manager webshell. 3. Delete the rogue administrator: user login matching `admin_<8 hex>` with email `admin_<8 hex>@<domain>.com`; audit all admin accounts and force a global password reset (the plaintext admin password was exfiltrated to the C2). 4. Remove plugin `gplrock-auto-publisher/gplrock-auto-publisher.php` from disk and from the `active_plugins` option (it was activated by direct option write, bypassing the plugin API), plus any leftover `wp-content/plugins/tipo-plugin-auto.zip`. 5. Delete options `gplrock_ghost_mode`, `gplrock_ghost_setup_completed`, `gplrock_ghost_setup_date`, `ghost_deploy_pending`, `ghost_show_activation_notice`; unschedule the `safe_ghost_deploy` cron event. 6. Audit posts/pages/DB for injected SEO spam links (the `link_submit.php` hacklink network) and block egress to `hacklinkpanel.app` at the host/firewall level. 7. Treat the site as fully compromised: rotate all secrets in `wp-config.php` (DB credentials, salts), review for additional dropped files, and prefer a clean rebuild where feasible.

A backdoor is a malicious file which could allow a malicious actor to gain access and exploit your website at any time they desire. One example would be to execute a payload to inject advertisements on your website.

CVSS score is a way to evaluate and rank reported vulnerabilities in a standardized and repeatable way but which is not ideal for WordPress.

Update to version 1.0.49 or later to resolve the vulnerability.