I'm not understanding how this is a trojan. Is it a plug-in which the admin has to install? Is it some other unrelated application which the admin has to downlo

I'm not understanding how this is a trojan. Is it a plug-in which the admin has to install? Is it some other unrelated application which the admin has to download from the web and run which infects WordPress sites? How do the 30 vulnerabilities fit into this? And what part of it is a backdoor? It looks like the C&C server can only tell the software what page to redirect to? That's not the sort of access I generally associate with a "backdoor"...