A post-exploitation artifact is a file, system change, or log trace left behind after an attacker has gained access. Examples include an unfamiliar plugin or web shell, modified configuration files, newly created accounts, and unusual entries in web server logs.
These artifacts help defenders investigate whether a vulnerable system was actually compromised and what the attacker may have done. In a WordPress incident, updating Core can close an entry point but does not remove attacker-written files or undo other changes. Check recent file changes and plugin directories, review logs for suspicious requests, and investigate unexpected accounts or configuration changes. Treat findings as evidence to assess, not proof on their own: legitimate maintenance or system activity can also create unusual traces.