Recently a couple of sites we had built have been used to send a tonne of spam emails. We aren't security experts, but with some research believe that it may be some kind of PHP Injection taking place. We managed to remove the infected files from the site/s and have implemented extra software to manage the security better - however, attacks are still being attempted and we aren't sure which file it is that is vulnerable.
We have the following report from one of our plugins (it's a WordPress site), which shows multiple attempts to traverse the directory and upload malicious files. Our worry is that without this plugin the culprit would have had easy access to carry out said attacks - but the scan shows directory's that do not exist?
I guess my question is this: what is it the attacker is doing (in terms of the hack) and why is it showing directories that do not exist? The end goal is to re-factor the code to deminish the apparant exploit - when we know which file it is...
Apologies if this is a bad question or is in the wrong section - I am new to Stack Exchange but am in desperate need of some security expertise!