I am not quite sure if simply updating WP works. My Blog was hacked as well. I was using the previous version of WP (the very previous, not an old one). I’ve upgraded, manually remove the code within the header.php page and the site came back to normal (https://wyse.com.br/blog).
As an extra precaution I logged in using a FTP software, went to THEMES, and manually set the permissions of the header file NOT to be written by anyone.
I also installed a FIREWALL WP plug-in.
I hope it works and help others.
