Being Hacked

I’d encourage you to go through and purage all your user accounts, specifically their passwords.

Also look to add Two Factor authentication, look at the Google Authenticator plugin.

If they have a backdoor though they’ll be able to bypass those.

You need to start working your way through these resources:

https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/

Additional Resources:

https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html
Requesting Support for a Commercial Product