Site infected with adminer.php

I have the premium version and the firewall enabled on my WordPress site but still the site got infected. How is that possible?

Here is the infection

File appears to be malicious: adminer.php
Filename: adminer.php
File type: Not a core, theme or plugin file.
Issue first detected: 36 mins ago.
Severity: Critical
Status New
This file appears to be installed by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The text we found in this file that matches a known malicious file is: “if($_GET[“file”]==”favicon.ico”){header(“Content-Type: image/x-icon”);echo lzw_decompress(“. The infection type is: G311 – obuscated code

https://ww.wp.xz.cn/plugins/wordfence/