One of our WordPress sites has been compromised but we're currently unsure how. The primary hypothesis is that an installed plugin was vulnerable to a remote code execution vulnerability which gave an attacker access to the underlying operating system of the server.
To start, we can first filter for anything understand what are HTTP STATUS CODES And what type of access.log information it gives us.
Below is a sample access log entry. Depending on the context, each field can indicate either benign or malicious traffic. While not all access logs follow this exact format, they generally include the following information:
| Log Field | Example Indicator |
|---|---|
| 1. Client IP Address | A known malicious or outside of the expected geo range |
| 2. Timestamp and Requested Page | Requests made at unusual hours or repeated in a short period of time |
| 3. Status Code | Repeated 404 responses indicating a page could not be found |
| 4. Response Size | Significantly smaller or larger than normal response sizes |
| 5. Referrer | Referring pages that don't fit normal site navigation |
| 6. User-Agent | Outdated browser versions or common attack tools (e.g. sqlmap, wpscan) |
While access logs are useful, they do not always capture the full contents of a request, particularly the body of POST or GET requests. For example, a login attempt may appear in access logs as:
10.10.10.100 [12/Aug/2025:14:32:10] "POST /login HTTP/1.1" 200 532 "/home.html" "Mozilla/5.0"
The above sample log shows the request method, the requested page, and the status code, but not the actual credentials or payload that was submitted in the request. Importantly, access logs do not record the actual POST body data, such as submitted credentials, so investigators can only see that the request occurred. GET requests may log full paths and query strings, but some log formats won't include them at all. It depends entirely on the server software being used and the logging configuration.
First thing I would do to investigate this if I do not have a linux box but lets say we wanted to go the windows route is
