Public disclosure by the people that found the backdoor. I couldn't find any disclosure about it by AccessPress themselves between 15. October when they pulled the compromised themes and plugins to now.