How to Remove Phoenix Exploit From Your WordPress Install

1. Log in to your WordPress blog.
2. Click 'Administration.' Click 'Users.' Click 'All Users.'

3. Look through the Users list for administrator level accounts which you did not create. Check these accounts and select 'Delete' from the bulk actions list. Choose 'Delete all posts and links.'
4. Click 'Appearance' and 'Editor' to access the theme editor. Look through your theme files for links to sites that you never put on your site. Likely places for the malicious code would be your header.php or your footer.php files, as these files are pulled and displayed on every page of your site. Delete the code and save your changes.
5. Click 'Tools.' Click 'Update.' Click 'Update Automatically' to update your WordPress installation to the most recent version.