I have a reoccurring infection on several sites on one server – I’m able to find and remove the files – they’re in the form of randomly named plugins, consistently being installed with the same name in the same sites, and I can’t locate the source of the infection. There are no cron tasks, and Wordfence and GOTMLS doesn’t identify any issues, so I’m at a loss for where to look to eradicate the infection.
I have samples of the plugins I could provide if that might help identify the source.