title: Wordpress Twenty Eleven searchform.php vulnerability
body: <p>My Wordpress Twenty Eleven searchform.php got hacked and created evil <code>eval(base64_decode("Hi I have hacked your site. Haha"))</code>
  I quickly found this out from my Nginx access log, found the script as it was executing via HTTP protocol, then put an exit at the first line which now stopped the script generating mass spam mails from my server.</p>
  
  <p>My question is how can this happen initially? Did the hacker posted some POST or GET variables via the form in <code>searchform.php</code> knowing that at some stage it would be executed with <code>eval()</code> function so included something like <code>fopen</code> and <code>fwrite</code> as part of the string?</p>
  
  <p>If so, where is this <code>eval()</code> located and how does it get processed?</p>
  
  <p>My <code>searchform.php</code> got completely rewritten</p>
  
  <p>Any ideas guys?</p>