Anatomy of a compromised WordPress site

A small healthcare practice asked me to look at their WordPress site after spam pages started appearing in search results.

Root cause

The access logs showed a successful admin login, followed minutes later by a plugin upload.