“The only way to detect this threat is to use a core file integrity monitoring solution, as the malware deletes the “initial.php” file dropper to cover its tracks.”
Attackers breached AccessPress itself and backdoored its themes and plugins at the source. Over 360,000 sites run its add-ons. Admins who did everything right, downloading from the vendor and updating promptly, got a webshell for their trouble. WordPress security is only as good as its weakest plugin vendor.