Luke Stevenson

It’s good that you have regained control of your login, by changing your password. I can share with you what the attackers did once they gained access through exploiting this Plugin, as it may assist you in working to remediate your website.

• Check Users
  Make sure that the attacker didn’t create a new Admin User account for them to continue to use after you regained control of your main admin account. (We didn’t see this, but it is a very simple tactic to retain persistent access after the initial attack.)
• Application Password
  Make sure that the attacker didn’t create an Application Password on any of your User accounts. This, again, allows for persistent access after you change your main password. We did see this in the attack here.
• Unusual Uploads
  Check in your wp-conten/uploads folder. The attacker may have uploaded files, including ZIP files, to deposit malicious code into your website files. We saw this here.
• New or Edited Files
  In our case, the attacker added a modified “wp-login.php” file into the wp-admin folder (they may have intended to replace the actual file in the root of the site, but that is unclear).
  They also injected code into the tops of a number of legitimate PHP files scattered around the site. The code is obviously obfuscated and may be randomised with each attack. But I would recommend taking a full download of your site, and then either comparing it with a fresh copy of WordPress from this site (so you can see whether the same core files have the same content), or running a search through the downloaded backup looking for “chr” and “base64”, two strings often associated with attackers trying to disguise the code they have injected.
• Install Security Plugins
  WP Cerber and Wordfence are good options, and both have free versions. WP Activity Log is great as you get an audit trail of anything anyone does on your site (so long as the attackers don’t purge it as part of their attack).
• Install a Backup Plugin/Solution
  If your site is your business, you need to protect it so that a server failure or attack doesn’t see all of your work disappear. Updraft is a good one here.
• Install a Tripwire
  A few years ago, I built a tool to detect changes in files within a website. Tripwire. It is low tech, easy to use, and independent of WordPress, so likely to avoid countermeasures.