My website stopped loading SVGs, Fluent form CSS and theme builder (editor page). When I checked the users list on my wp-admin panel, I saw a new admin user created on my WordPress website (username : wpadminee). I am unable to delete this user from the wp-admin dashboard. I tried deleting the user through SQL from wp\_users table but it recreates it again.
I think the site is some-how hacked and some code has been injected through a plugin. I am only using popular and authorised plugins. So not sure how this happened. I usually take backup snapshots of my Google VM every 8 hours and I have currently I restored an old backup. The site loads but I still see the wpadminee user in the list of users.
​
What is the right way to get this sorted now?
Thanks in advance for all the help.
[ad_2]
Your site is infected. It needs to be cleaned. First, install Wordfence and run a scan.
How to clean guide: https://www.hostinger.com/tutorials/wordpress-malware-removal#How_to_Remove_Malware_Manually_from_WordPress_Site
Hacked.
There’s code recreating the user.