One installs a fake plugin named “Ultra SEO Processor” that can execute commands remotely, one injects malicious JavaScript into wp-config.php ... a malicious PHP file and access it by ...