I don’t buy this. Why would someone risk their freedom for no financial gain. This isn’t a hacker it’s a whistleblower. If it was a backdoor exploit then why this statement:

‘We updated wpml.org, rebuilt everything and reinstalled everything. We secured access to the admin use 2-factor authentication and minimized the access that the web server has to the file system.’

Why not just remove the backdoor if everything was already perfectly fortified?

If a bank teller steals they don’t rebuild the bank…