Refugee Ball

This refugee-health charity's site had an active backdoor disguised as a caching plugin, plus a second fake “media engine” plugin that had been deactivated the day before the export — the signature of a rotating-dropper reinfection scheme designed to keep swapping in fresh backdoors. The way in was an unpatched, known vulnerability in the site's Salient theme components that had been ignored.

• Confirmed the active fake caching plugin as a backdoor and identified the recently-deactivated second fake plugin as evidence of dropper rotation.
• Pinned the entry vector to the unpatched Salient Core and Shortcodes vulnerabilities, and noted that Wordfence had indexed the fake-plugin files without flagging them as malware.
• Verified the file backup was clean (the fake plugin folders already removed) and confirmed the six user accounts were all legitimate with no injected scripts or spam.
• Verified the re-optimised, cleaned database export as clean across users, scripts, spam, payloads, cron, and suspicious domains — with only cosmetic security-tool history left behind.

The charity got a clear before-and-after: an infected database with the backdoor named and located, a clean file system, and a verified-clean database after cleanup — three reports in total. I was careful to keep the still-open server-level work explicit: patch the Salient entry vulnerability, rotate every credential, and harden, because a clean database does not by itself make the site immune.

A clean database is not an immune site. Saying so plainly — while the entry vulnerability was still unpatched — mattered more than declaring victory.