This site was found to be running unpatched software. It was possible to upload a file and execute code on the server without authentication.

Nothing was deleted. No data was copied. The server configuration and database were checked, then left as they were.

The site was rebuilt from the original files. What you see now is temporary.

—

Patch the plugin. Rotate the database credentials and the WordPress salts. Review the upload directory for files that do not belong.

blindfool
IBS