XMAN Replicator

Name	Size	Rights	Date	Actions
[.]	<DIR>	drwxr-x---	2026-06-15 11:12	🔄 🗑️ 🗑️📁 ⬇️ 🔒
[..]	<DIR>	drwx--x--x	2026-06-10 21:24	🔄 🗑️ 🗑️📁 ⬇️ 🔒
.hcflag	31 B	-rw-r--r--	2026-06-10 17:41	✏️ 🔄 🗑️ ⬇️ 🔒
.htaccess	2,930 B	-r-xr-xr-x	2026-06-11 03:00	✏️ 🔄 🗑️ ⬇️ 🔒
.htaccess.bak-20260611	523 B	-rw-r--r--	2026-06-11 03:00	✏️ 🔄 🗑️ ⬇️ 🔒
.htaccess.bk	551 B	-rw-r--r--	2025-12-09 04:50	✏️ 🔄 🗑️ ⬇️ 🔒
.litespeed_flag	297 B	-rw-r--r--	2026-06-15 01:34	✏️ 🔄 🗑️ ⬇️ 🔒
[.tmb]	<DIR>	drwxrwxrwx	2026-06-09 05:56	🔄 🗑️ 🗑️📁 ⬇️ 🔒
bottom-1781097958.php	0 B	-rw-r--r--	2026-06-10 13:25	✏️ 🔄 🗑️ ⬇️ 🔒
class-wp-locale-compat.php	598 B	-rw-r--r--	2026-05-20 13:39	✏️ 🔄 🗑️ ⬇️ 🔒
custom-file-5-1780984631.php	0 B	-rw-r--r--	2026-06-09 05:57	✏️ 🔄 🗑️ ⬇️ 🔒
error_log	1,570,194 B	-rw-r--r--	2026-06-15 19:45	✏️ 🔄 🗑️ ⬇️ 🔒
femauito_wp313_malware.sql	5,943,079 B	-rw-r--r--	2025-12-09 04:50	✏️ 🔄 🗑️ ⬇️ 🔒
goods.php	328 B	-rw-r--r--	2026-06-11 03:01	✏️ 🔄 🗑️ ⬇️ 🔒
google59c8bb44196919b8.html	53 B	-rw-r--r--	2026-06-11 03:01	✏️ 🔄 🗑️ ⬇️ 🔒
google582566b8f7d45475.html	53 B	-rw-r--r--	2026-06-11 03:01	✏️ 🔄 🗑️ ⬇️ 🔒
googled04d588160dddfa6.html	53 B	-rw-r--r--	2026-06-11 03:01	✏️ 🔄 🗑️ ⬇️ 🔒
googleffcdbb1395f04c94.html	53 B	-rw-r--r--	2026-06-11 03:01	✏️ 🔄 🗑️ ⬇️ 🔒
index.php	40,773 B	-rw-r--r--	2026-06-15 11:12	✏️ 🔄 🗑️ ⬇️ 🔒
license.txt	19,903 B	-rw-r--r--	2026-05-21 02:37	✏️ 🔄 🗑️ ⬇️ 🔒
readme.html	7,406 B	-rw-r--r--	2026-05-21 02:37	✏️ 🔄 🗑️ ⬇️ 🔒
robots.txt	72 B	-rw-r--r--	2026-06-15 19:57	✏️ 🔄 🗑️ ⬇️ 🔒
shop.php	328 B	-rw-r--r--	2026-06-11 03:01	✏️ 🔄 🗑️ ⬇️ 🔒
wp-activate.php	7,371 B	-rw-r--r--	2026-05-21 02:37	✏️ 🔄 🗑️ ⬇️ 🔒
[wp-admin]	<DIR>	drwxr-xr-x	2026-06-11 03:01	🔄 🗑️ 🗑️📁 ⬇️ 🔒
wp-blog-header.php	351 B	-rw-r--r--	2025-12-09 04:50	✏️ 🔄 🗑️ ⬇️ 🔒
wp-comments-post.php	2,323 B	-rw-r--r--	2025-12-09 04:50	✏️ 🔄 🗑️ ⬇️ 🔒
wp-config-sample.php	3,339 B	-rw-r--r--	2026-05-21 02:37	✏️ 🔄 🗑️ ⬇️ 🔒
wp-config.php	3,514 B	-rw-r--r--	2026-06-10 01:40	✏️ 🔄 🗑️ ⬇️ 🔒
[wp-content]	<DIR>	drwxr-xr-x	2026-06-15 17:37	🔄 🗑️ 🗑️📁 ⬇️ 🔒
wp-cron.php	5,617 B	-rw-r--r--	2025-12-09 04:50	✏️ 🔄 🗑️ ⬇️ 🔒
[wp-includes]	<DIR>	drwxr-xr-x	2026-06-15 17:37	🔄 🗑️ 🗑️📁 ⬇️ 🔒
wp-links-opml.php	2,493 B	-rw-r--r--	2025-12-09 04:50	✏️ 🔄 🗑️ ⬇️ 🔒
wp-load.php	3,937 B	-rw-r--r--	2025-12-09 04:50	✏️ 🔄 🗑️ ⬇️ 🔒
wp-login.php	51,970 B	-rw-r--r--	2026-06-11 03:00	✏️ 🔄 🗑️ ⬇️ 🔒
wp-mail.php	8,727 B	-rw-r--r--	2025-12-09 04:50	✏️ 🔄 🗑️ ⬇️ 🔒
wp-settings.php	32,650 B	-rw-r--r--	2026-05-21 02:37	✏️ 🔄 🗑️ ⬇️ 🔒
wp-signup.php	34,621 B	-rw-r--r--	2026-05-21 02:37	✏️ 🔄 🗑️ ⬇️ 🔒
wp-trackback.php	5,214 B	-rw-r--r--	2025-12-09 04:50	✏️ 🔄 🗑️ ⬇️ 🔒
xmlrpc.php	3,205 B	-rw-r--r--	2025-12-09 04:50	✏️ 🔄 🗑️ ⬇️ 🔒

Edit: xmlrpc.php

<?php
/**
 * XML-RPC protocol support for WordPress
 *
 * @package WordPress
 */

/**
 * Whether this is an XML-RPC Request.
 *
 * @var bool
 */
define( 'XMLRPC_REQUEST', true );

// Discard unneeded cookies sent by some browser-embedded clients.
$_COOKIE = array();

// $HTTP_RAW_POST_DATA was deprecated in PHP 5.6 and removed in PHP 7.0.
// phpcs:disable PHPCompatibility.Variables.RemovedPredefinedGlobalVariables.http_raw_post_dataDeprecatedRemoved
if ( ! isset( $HTTP_RAW_POST_DATA ) ) {
	$HTTP_RAW_POST_DATA = file_get_contents( 'php://input' );
}

// Fix for mozBlog and other cases where '<?xml' isn't on the very first line.
$HTTP_RAW_POST_DATA = trim( $HTTP_RAW_POST_DATA );
// phpcs:enable

/** Include the bootstrap for setting up WordPress environment */
require_once __DIR__ . '/wp-load.php';

if ( isset( $_GET['rsd'] ) ) { // https://cyber.harvard.edu/blogs/gems/tech/rsd.html
	header( 'Content-Type: text/xml; charset=' . get_option( 'blog_charset' ), true );
	echo '<?xml version="1.0" encoding="' . get_option( 'blog_charset' ) . '"?' . '>';
	?>
<rsd version="1.0" xmlns="http://archipelago.phrasewise.com/rsd">
	<service>
		<engineName>WordPress</engineName>
		<engineLink>https://wordpress.org/</engineLink>
		<homePageLink><?php bloginfo_rss( 'url' ); ?></homePageLink>
		<apis>
			<api name="WordPress" blogID="1" preferred="true" apiLink="<?php echo site_url( 'xmlrpc.php', 'rpc' ); ?>" />
			<api name="Movable Type" blogID="1" preferred="false" apiLink="<?php echo site_url( 'xmlrpc.php', 'rpc' ); ?>" />
			<api name="MetaWeblog" blogID="1" preferred="false" apiLink="<?php echo site_url( 'xmlrpc.php', 'rpc' ); ?>" />
			<api name="Blogger" blogID="1" preferred="false" apiLink="<?php echo site_url( 'xmlrpc.php', 'rpc' ); ?>" />
			<?php
			/**
			 * Fires when adding APIs to the Really Simple Discovery (RSD) endpoint.
			 *
			 * @link https://cyber.harvard.edu/blogs/gems/tech/rsd.html
			 *
			 * @since 3.5.0
			 */
			do_action( 'xmlrpc_rsd_apis' );
			?>
		</apis>
	</service>
</rsd>
	<?php
	exit;
}

require_once ABSPATH . 'wp-admin/includes/admin.php';
require_once ABSPATH . WPINC . '/class-IXR.php';
require_once ABSPATH . WPINC . '/class-wp-xmlrpc-server.php';

/**
 * Posts submitted via the XML-RPC interface get that title
 *
 * @name post_default_title
 * @var string
 */
$post_default_title = '';

/**
 * Filters the class used for handling XML-RPC requests.
 *
 * @since 3.1.0
 *
 * @param string $class The name of the XML-RPC server class.
 */
$wp_xmlrpc_server_class = apply_filters( 'wp_xmlrpc_server_class', 'wp_xmlrpc_server' );
$wp_xmlrpc_server       = new $wp_xmlrpc_server_class();

// Fire off the request.
$wp_xmlrpc_server->serve_request();

exit;

/**
 * logIO() - Writes logging info to a file.
 *
 * @since 1.2.0
 * @deprecated 3.4.0 Use error_log()
 * @see error_log()
 *
 * @global int|bool $xmlrpc_logging Whether to enable XML-RPC logging.
 *
 * @param string $io  Whether input or output.
 * @param string $msg Information describing logging reason.
 */
function logIO( $io, $msg ) {
	_deprecated_function( __FUNCTION__, '3.4.0', 'error_log()' );
	if ( ! empty( $GLOBALS['xmlrpc_logging'] ) ) {
		error_log( $io . ' - ' . $msg );
	}
}

🛸 XMAN Replicator

Edit: xmlrpc.php

PHP Console

SQL Console