I would like some advice on how to troubleshoot a problem on Wordpress/Apache/PHP/MySQL
I am looking at the following: select * from wp_options opt where option_name like '%wp_user_roles%' order by option_name
Yesterday, for some reason, all the user roles except the ones for a specific plugin was deleted. (all-in-one-event-calendar). (including the administrator role, which meant that I couldn't get into wp-admin.) I found the problem, and restored the entry from a backup of that table entry, which got things working again. However, a day later, the roles were deleted again.
What are the steps I should take to troubleshoot this? Have done the following:
I checked all the Apache access logs and error logs at around the time it happened (both times). I can almost pinpoint the time it occurs because the deletion of the roles causes my site to give a white screen and no response. Once it happens, my access logs shows that all responses to Wordpress pages have a size of 0MB. Therefore, the time that the Apache responses become size 0, should be the approximate time that the deletion occured.
I can't see any suspicious activity around the time the deletions happened.
I've geolocated the ip addresses, and checked them against stopforumspam and projecthoneypot databases to see if there were any bad ips around that time. Also, the access logs just show some GETS to normal pages and files. I don't see any bad POSTS or malformed urls. This is an imperfect solution, since manually looking over logs is difficult.
I've also checked the php errors, but haven't found any issues.
I've turned on MySQL binary logs. Hopefully, next time something updates the wp_options table, I will see the exact query that did it.
I've updated Wordpress core, and all plugins.
I've audited the code for the plugin whose access rights haven't been deleted.
I've disabled that plugin just in case.
I've updated my antivirus on that machine, and did a fulls scan (no results).
I used WordFence security scanner scan all my files for infection (no results).
I've used Wordfence to block ALL countries outside of the U.S. (we don't do business outside).
From the access logs, I see no evidence that anyone made any attempts to log in, which is good. Wordfence shows that the only login attempts for my Admin accounts are from my local ip (and no excessive failed attempts).
Are there any other steps that I should take to find the root cause of the roles being deleted? If I just have to keep restoring the roles, it's a nuisance. But I am worried that this is some sort of attack.