# Find every copy of a file by basename
sudo find / -name 'password.php' 2>/dev/null

# Or for any file in a plugin
sudo find / -path '*plugins/password*' 2>/dev/null

# Watch what files PHP-FPM opens during a request
sudo strace -f -e openat -p $(pgrep -f 'php-fpm: pool' | head -1) 2>&1 | grep -i password