Fondation Nestlé France had a WordPress site built by an agency that no longer followed it. Two problems arrived at once: the editorial team could no longer update its media, and the group's security service had just reported a hole in the WordPress core. The engagement was brought to me by the Skilld agency, which I worked with regularly, and I ran it directly.
The project in detail
The editorial blocker came from a plugin, Magic Fields 2, that the original agency had used to customise post types. Updating it fixed the fault, but the diagnosis did not stop there: that plugin had been pulled from the official WordPress repository, which made its fixes far harder to get. A site whose central part is no longer distributed by its supplier is a site whose next failure will have no fix.
On the security side the scan identified fourteen vulnerabilities in the core, and fourteen more spread across four plugins that had not been updated in years, some several major versions behind. Moving the core to the latest stable version closed the hole flagged by the group's security service and most of the others. The plugins were dealt with one by one.
I also worked inside the theme, replacing PHP functions that had become obsolete. That is the kind of fix you have to make and at the same time have to flag as a symptom: swapping a function for a newer one gets you through the day, but repeated over years it produces code nobody can pick up.
The engagement ended with a written report rather than a closing message. It listed what had been fixed, and above all two reasoned recommendations: replace Magic Fields 2 with Advanced Custom Fields, a plugin with the same purpose but maintained by a company that has made it its flagship product, and consider a technical rebuild of the theme. A technical rebuild changes neither the visuals nor the features offered to visitors, but it allows several decaying plugins to be removed and lastingly reduces maintenance time and attack surface.
This is the shape of all my takeovers of existing work: fix what blocks, close what is open, then say in writing what remains to be decided, with the reasons.