ragnew

The bad guys may have uploaded a hidden shell file somewhere that allows them to have access and alter your site they have uploaded a script when accessed alters your index.php file.

It could be buried anywhere.

Do you only have one one instance of wordpress?

Best not to have multiple instances on the same account.

Here is a simple hacked site tutorial that I did.
https://www.computer-geek.net/how-to-fix-your-hacked-wo-va-65.html

The WordPress hacker situation is getting crazy out of hand.
The bad guys are everywhere.
Most of them are from outside the USA.

Removing the malware off your site is only half the battle.

Its not enough to do some WordPress updates and change your hosting passwords. The hackers can still get you.

There are so many vulnerabilities that its is almost impossible to keep on top of it.

You need to find a way to clean and then secure your site so the hackers will go somewhere else.