Yes I can explain what is happening, I doubt people will benefit from this explanation because most of the time they just read the title so they generally do not get to read the comments that are at the end of the thread. I will try to elaborate this and give more information in an official article in the “Sucuri Knowledge Base” website [1].
Here are two things mixed in the same audit logs, so I will explain them separatetly. The first one is the upload of the “ajax.zip” file and consequently the injection of the (supposedly) malicious code. The second are the logs pointing to a deletion of some posts.
Upload of Malware
The scenario was like this: A malicious person got the credentials to access one of the user accounts registered in the website, he/she continued to check if the privileges of the account were sufficient to inject malicious code, then went to the “Media Library” page and uploaded a file named “ajax.zip”. It seems like the archive contained a valid theme and WordPress generally extracts the content of any compressed file related with a plugin/theme and then deletes the archive when the operation succeeds, this is why you did not find the “ajax.zip” file but only the PHP files under the /wp-content/themes/ajax/ directory.
Note that this is only an assumption, I do not really know who accessed your site nor his/her intentions because I do not have access to the logs to run a professional forensic audit.
Posts Deleted
The logs with the text “Post deleted; identifier: ###” are not malicious, at least not in this case. There could be three scenarios that will generate these logs. One is a manual deletion of a post or page, second is the auto deletion of the drafts if you configured WordPress to do this, and third is a deletion of a temporary post created by a plugin. The latter is the most common reason that I have seen in the wild.
I have found that many plugins that offer custom forms for a contact page, feedback, billing, etc create temporal entries in the “wp_posts” table before the data stored there is sent via email to someone else or until the entry expires or something like that.
This is why I decided to add a panel in the plugin’ settings page named “Ignore Alerts” which contains a list of custom post types that are mainly created by WordPress to manage different entries in the same database table, for people that do not know WordPress stores the posts and pages (among other things) in the same table and uses a column named “post_type” to distinguish between them. You can use the “Ignore Alerts” panel to force the plugin to not send email alerts about post deletion of custom post types.
Conclusion
You already deleted the suspicious PHP files that were injected, good. Now you have to check if there are new user accounts and delete them. Also go to the “Post-Hack” page and reset the password of the users that you do not trust, generate new WordPress secret key, and reset the plugins that are active. This will do the trick.
Optional
I also recommend you to check our Web Application Firewall – CloudProxy [2] [3] it has awesome features that you may want to use to protect your site against future attacks. Let me know if you need more information.
[1] https://kb.sucuri.net/
[2] https://cloudproxy.sucuri.net/
[3] https://sucuri.net/website-firewall/
