Wordpress site with spam ads "malware" - What those logs mean? - wordpress

Question

I've got some trouble lasts days with one of my WordPress installation that got infected with spam "malware".
I've backed up then removed the WordPress installation from server that got infected based on time of hack (index.php/wp-blog-header.php last modified (17:45)) and those server logs :
www.-.com:443 176.124.214.245 - - [17/Jan/2023:17:44:24 +0100] "POST /wp-login.php HTTP/2.0" 302 0 "https://www.-.com/wp-login.php?redirect_to=https%3A%2F%2Fwww.-.com%2Fwp-admin%2F" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0"
www.-.com:443 176.124.214.245 - - [17/Jan/2023:17:44:27 +0100] "GET /wp-admin/edit.php HTTP/2.0" 200 34958 "https://www.-.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0"
www.-.com:443 176.124.214.245 - - [17/Jan/2023:17:44:29 +0100] "GET /wp-admin/edit.php HTTP/2.0" 200 34959 "https://www.-.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0"
www.-.com:443 176.124.214.245 - - [17/Jan/2023:17:44:36 +0100] "GET /wp-admin/plugin-install.php HTTP/2.0" 200 28446 "https://www.-.com/wp-admin/edit.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0"
www.-.com:443 176.124.214.245 - - [17/Jan/2023:17:44:46 +0100] "POST /wp-admin/update.php?action=upload-plugin HTTP/2.0" 200 20152 "https://www.-.com/wp-admin/plugin-install.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0"
www.-.com:443 176.124.214.245 - - [17/Jan/2023:17:45:02 +0100] "GET /wp-admin/plugins.php HTTP/2.0" 200 27990 "https://www.-.com/wp-admin/update.php?action=upload-plugin" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0"
www.-.com:443 176.124.214.245 - - [17/Jan/2023:17:45:14 +0100] "GET /wp-admin/plugins.php?action=activate&plugin=blocks-kit%2fblocks-kit.php&plugin_status=all&paged=1&s&_wpnonce=5ba12068a9 HTTP/2.0" 302 0 "https://www.-.com/wp-admin/plugins.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0"
I've replaced the domain
Multiple attemps with different IP has been made during the day, 17:45 was the one I think got through
If I understand correctly:
hacker got successfully logged in (wp-login.php)
installed a plugin (/wp-admin/plugin-install.php?action=upload-plugin)
activated the plugin (/wp-admin/plugins.php?action=activate&plugin=blocks-kit%2fblocks-kit.php&plugin_status=all&paged=1&s&_wpnonce=5ba12068a9)
Wordpress executed the blockskit.php?
Server got infected
I didn't found any "malware" on the blocks-kit plugin. Maybe I didn't knew what to search.
Other informations:
Password to access admin was like "#Qh%RidZd#MwFUXT" - I don't think it was brute forced.
Plugins:
Mailchimp (4.8.7) no vulnerabilities for this version.
Booked (2.3.5)- same
Better Search replace (1.3.4) - Admin + SQLi
trx_updater (1.9.6) - nothing
js_composer (6.7.0) - nothing
advanced-custom-fields (5.11.4) - Unauthenticated File Upload
trx_addons (?) - No issues found in the plugin
revslider (6.5.11) - nothing
essential-grid - nothing
duplicate-page (4.4.8) - nothing
contact-form-7 (5.5.4) - nothing
blocks-kit.php
// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
exit;
}
define('BK_PLUGIN_DIR', plugin_dir_path(__FILE__));
define('BK_PLUGIN_URL', plugins_url('/', __FILE__));
define('BK_DOMAIN','blocks-kit');
/**
* Block Initializer.
*/
require_once plugin_dir_path( __FILE__ ) . 'src/init.php';
Based on all information, seems to me that the hacker got through thanks to an outdated plugin.
I'm not here for a solution, but more to help me understand a little more in depth.
I would have loved if someone more experienced help me understand those servers logs/situation.