Turn a security scan into a triage and hardening plan

Wordfence just flagged this on a client's WooCommerce store:

[- A file at /wp-content/uploads/2026/03/wp-cache-abc123.php flagged as
"Backdoor:PHP/eval"
- 3 unrecognized admin-level user accounts created in the last 48 hours
- A core file modification warning on wp-includes/functions.php]

SITE CRITICALITY: [active store with stored customer names, addresses, and order
history, no stored card numbers, those go through a payment gateway]

Triage and plan this the way an incident responder would, not a generic hardening
checklist:
1. For each finding, state whether it's confirmed malicious, needs verification, or a
   plausible false positive, and why. A PHP file in `/uploads/` running eval-style
   code is almost never a false positive, since uploads shouldn't execute PHP at all,
   which should shape how urgently you treat the other two findings.
2. Sequence containment before cleanup: given the confirmed backdoor and rogue admin
   accounts, what needs to happen in the next 15 minutes (site into maintenance
   mode, force-reset all admin passwords and API keys, revoke active sessions) before
   touching a single file. The order matters, because cleaning up first while the
   backdoor still grants access just means it gets recreated.
3. Remediation steps in order: quarantine or remove the malicious file, remove the
   rogue accounts, diff the flagged core file against a clean WordPress core copy of
   the same version to confirm exactly what changed.
4. Given SITE CRITICALITY involves customer PII, state whether this rises to a
   breach-notification question, and say plainly that this can help you triage but
   isn't a substitute for legal or compliance advice on disclosure obligations.
5. Root-cause the entry point before restoring anything. A backdoor plus new admin
   accounts strongly suggests a compromised admin credential or a vulnerable plugin,
   not a random drive-by. State which is more likely from what's given, and what
   you'd check next to confirm it.