found the complete Log in another Post of you.
Here is what I read from it:
The GET Request for the Files wp-login.php from 91.210.145.98 (Windows 10 64Bit, with probably Mozilla Firefox 50) is 200
200 = HTTP Statuscode = OK which means successfull.
The POST of the Login Data was successfull. (A interesting thing is, that i dont see any Bruteforce signs in the LOG you posted).
The Attacker is now successfull logged in (access to wp-admin)
The Attacker opens the Theme Editor. (/wp-admin/theme-editor.php)
The Attacker checks if the Theme TwentyFourteen already exists. ( /wp-admin/theme-editor.php?file=404.php&theme=twentyfourteen)
The Attacker opens the Page to upload a Theme.
The Attacker binds an Wordpress Remote Shell to the database.php of the Theme Gaukingo (Wordpress Shell Uploader\gaukingo)
and uploads it.
The Attacker binds an Wordpress Remote Shell to the db.php of the Plugin three-column-screen-layout (three-column-screen-layout/db.php)
and uploads it.
He checks if the File GET /wp-content/uploads/db.php already exist but gets an HTTP 404 which means Not Found.
He does the same with /wp-content/uploads/2017/23/db.php.
He issues an HEAD Request which means he just recieves Homepage Header Data, which is faster for example if you want to recieve Data in a Linux-Shell.
Maybe he is using a Program like Metasploit from now on because he has way more possibel Browsers (Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36 OPR/32.0.1948.45)
- He logs on via wp-login.php
- He opens the Page to upload a Theme
- He checks if the Theme sketch is already installed text here
After I read the Log I think he is trying to use a weakness in outdated but still installed Plugins and Themes. I think it's the best to secure your Wordpress in the future as suggested in the Comments.
[30/Mar/2017:13:52:56 +0100] "GET /wp-login.php HTTP/1.1" 200 2752 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - -
[30/Mar/2017:13:52:57 +0100] "POST /wp-login.php HTTP/1.1" 302 1136 "http://*************.com.it/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - -
[30/Mar/2017:13:52:58 +0100] "GET /wp-admin/ HTTP/1.1" 200 62061 "http://*************.com.it/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - -
[30/Mar/2017:13:52:59 +0100] "GET /wp-admin/theme-editor.php HTTP/1.1" 200 38782 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - -
[30/Mar/2017:13:53:00 +0100] "GET /wp-admin/theme-editor.php?file=404.php&theme=twentyfourteen HTTP/1.1" 500 3785 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - -
[30/Mar/2017:13:53:01 +0100] "GET /wp-admin/theme-install.php?upload HTTP/1.1" 200 52466 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - -
[30/Mar/2017:13:53:02 +0100] "POST /wp-admin/update.php?action=upload-theme HTTP/1.1" 200 31812 "*************.com.it/wp-admin/theme-install.php?upload" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - -
[30/Mar/2017:13:53:07 +0100] "GET /wp-content/themes/F:\xc4\xee\xf0\xee\xe3\xee\xf1\xf2\xee\xff\xf9\xe8\xe5\MultiShell2\xf8\xe5\xeb\xeb\xfb\xcf\xee\xea\xf3\xef\xed\xee\xe9 \xf1\xee\xf4\xf2\uploader\Wordpress Shell Uploader\gaukingo/db.php HTTP/1.1" 404 51872 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - -
[30/Mar/2017:13:53:08 +0100] "GET /wp-admin/plugin-install.php?tab=upload HTTP/1.1" 200 40682 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - -
[30/Mar/2017:13:53:09 +0100] "POST /wp-admin/update.php?action=upload-plugin HTTP/1.1" 200 31541 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - -
[30/Mar/2017:13:53:15 +0100] "GET /wp-content/plugins/F:\xc4\xee\xf0\xee\xe3\xee\xf1\xf2\xee\xff\xf9\xe8\xe5\MultiShell2\xf8\xe5\xeb\xeb\xfb\xcf\xee\xea\xf3\xef\xed\xee\xe9 \xf1\xee\xf4\xf2\uploader\Wordpress Shell Uploader\three-column-screen-layout/db.php HTTP/1.1" 404 51874 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - -
[30/Mar/2017:13:53:16 +0100] "POST /wp-admin/update.php?action=upload-plugin HTTP/1.1" 200 31426 "*************.com.it/wp-admin/theme-install.php?tab=upload" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - -
[30/Mar/2017:13:53:19 +0100] "GET /wp-content/uploads/db.php HTTP/1.1" 404 51729 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - -
[30/Mar/2017:13:53:20 +0100] "GET /wp-content/uploads/2017/23/db.php HTTP/1.1" 404 51753 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0" 91.210.145.98 - -
[30/Mar/2017:13:58:22 +0100] "HEAD /wp-login.php HTTP/1.1" 200 343 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36 OPR/32.0.1948.45" 91.210.145.98 - -
[30/Mar/2017:13:58:23 +0100] "GET /wp-login.php HTTP/1.1" 200 2697 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36 OPR/32.0.1948.45" 91.210.145.98 - -
[30/Mar/2017:13:58:23 +0100] "POST /wp-login.php HTTP/1.0" 302 1305 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36 OPR/32.0.1948.45" 91.210.145.98 - -
[30/Mar/2017:13:58:24 +0100] "POST /wp-admin/ HTTP/1.0" 200 61984 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36 OPR/32.0.1948.45" 91.210.145.98 - -
[30/Mar/2017:13:58:25 +0100] "GET /wp-admin/theme-install.php HTTP/1.1" 200 52420 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36 OPR/32.0.1948.45" 91.210.145.98 - -
[30/Mar/2017:13:58:27 +0100] "POST /wp-admin/update.php?action=upload-theme HTTP/1.0" 200 32257 "http://*************.com.it/wp-admin/theme-install.php?upload" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36 OPR/32.0.1948.45" 91.210.145.98 - -
[30/Mar/2017:13:58:33 +0100] "GET /wp-content/themes/sketch/404.php HTTP/1.1" 200 377 "http://*************.com.it/wp-admin/theme-install.php?upload" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36 OPR/32.0.1948.45"