A detailed why or how is not going to be possible with the limited information you've provided. For a detailed forensic investigation we would need more than just an IP and arbitrary Username, in fact we would need everything... DB, access logs, changelogs, codebase - quite literally everything you've got and even then it's not easy, and not always possible to track down the exact cause. Even if you have the correct logs, once an attacker has access to your systems - those logs can potentially be doctored or deleted.
The best I can suggest is that if you use any of these
- Kiwi Social Share
- WordPress Automatic and Pinterest Automatic
- PublishPress Capabilities
- various Epsilon Framework themes
That there was a massive spike in attacks recently targeting known vulnerabilities in those plugins - see 1.6 Million WordPress Sites Hit With 13.7 Million Attacks In 36 Hours. These were recently disclosed vulnerabilities and ruthlessly targeted, with the time between disclosure and these attack vectors seen in the wild "en masse" being quite small. The time needed to patch your systems is getting smaller. Having up-to-date plugins the day after an attack won't save you.
Having said that, there are several ways you can keep on top of managing these potential threats.
Automatic updates - make sure that patch updates - IE the change in the last number X.X.(me!) are done immediately - patches don't generally contain breaking code changes when possible. Update on your test server, quick look and check on your vitals, then push live...
Keep abreast of the threats out there - I regularly read and subscribe to several vulnerability databases. For example:
Tool up - there are some tools to use - free and paid. Mostly the security by obscurity stuff doesn't work (you know what I mean - the hide login / wp-admin plugins - or the wp-xxxx folder rewrite plugins) but it can protect you from the brunt of some brute force "dumb" attacks. If it buys you an extra 12 hours to patch your plugins, that's 12 hours that can save your site from compromise. They are not to be relied on as "security" merely a layer of defence that slows down potential attacks. Brute force login protection is probably one of the more useful precautions here. The number of insane admin passwords I have been given during my freelancing days make me shudder - what are you doing if your main admin login is admin and Companyname1 as the super-admin?? I would regularly find logs on my sites to see 1,300 hits a day on guessing logins - those are on small sites from different IPs.
Tidy up - don't leave unused plugins active. If you're not using them, deactivate it. Each line of running code is a potential entry point to your site... At time of writing, that Patchstack page mentioned above - each page contains 20 vulnerabilities. Page one only goes back 5 days and I think that's because of the weekend...
Use your head - if you're installing a plugin that hasn't been updated in 2 years - please have a quick think... does that sound sensible?
Off the shelf - some tools can help you stay safer and offer a basic firewall-style protection.
Are two of the more popular choices and receive automatic firewall updates - although you will have to pay for the more advanced protections.
Infrastructure - there's no point in doing any of the above things if your infrastructure isn't secure. I don't need to compromise your plugins, logins or database if you use GoDaddy don't secure your infrastructure. Lock down SSH access - only allow server login with a secure key and please, it's so simple... Make a #@!$ing secure password to login to your server dashboard.
There are more and countless blogs on this. Just remember, we are pretty much now at the stage of - your site will be compromised... it's a fair amount work to make sure it isn't. Regularly audit your site contents - in terms of information stored... PII (Personally Identifiable Information) should be kept to a minimum for both you and your users. It's much less of a headache if or when something might happen.
I have no affiliation with any of the services mentioned above.
