Recent Writes
wp-content/plugins/.../init.php
read · output buffered
Clean
wp-content/uploads/.../wp-cache.php
eval(base64_decode(...)) · obfuscated
Quarantine
wp-content/themes/.../style.css
write · static asset
Clean
Behavioral verdict: backdoor
File looked normal but executed code from a remote URL — caught by what it does, not what it looks like.