Oh, and @aguinaldodarla – good suggestions all, and I had done that before I grew even more suspicious.
Apologies – I did finally find the problem (sort of) and fixed it. What happened is that I have the “Backup Migration” and “Backup Migration Pro” plugins. Out of an abundance of suspicion, I checked the Apache logs on my server and saw a lot of suspicious incoming traffic from “https://api.backupbliss.com”
I did a little investigation and discovered the “Backupbliss” had purchased these plugins from the original developers. The incoming traffic indicated that they may have backdoors, so I disabled both the plugins as a security risk. Incidentally, I was immediately able to do refunds and add notes to orders (another bit that was broken) again.
So – yet another reminder to keep an eyes on your plugins, because they can change…
