WTF? I thought I was hacked!

I spent some considerable time on one of my sites trying to find out how or who installed a “user membership” plugin searching through access and activity logs. I thought I was hacked. Later found out that the plugin completely changed directions.

I used to use this plugin which was for “User Avatars” not it’s a front facing entire membership / user profile / user profile plugin. I’ve been using WP since 2005 and fulltime developer for the last 5-6 years and I’ve never seen something like this before.

I’m on the hunt for something else.