Hacked

My test site for plugins and theme was hacked. Someone got in, created themselves user 1001001, no name or email, Administrator status. So far all thirty plugins were deactivated due to error about headers.

Under /plugins, the index.php file was changed (I need the right code)

[ Malware code redacted, please do not post that here ]

No idea what that hacked code does.

Besides asking that and for the right code, how did they get in to create a user as admin, edit directory files, and whatever else I find.