Wordpress is a very popular CMS script. As a result, wordpress site is target of many hacking attempts.

A wordpress website is scanned and is attacked 24/7. It is a matter of time the website is exploited if website owner does not update wordpress to latest version and apply enhanced hardening steps to secure wordpress site.

Wordpress has a guide what to do when wordpress site is hacked

https://wordpress.org/support/article/faq-my-site-was-hacked/

It is recommended to delete all files in hosting account, upload files from latest wordpress and update connection to existing database.

Hardening wordpress guide:

https://wordpress.org/support/article/hardening-wordpress/#securing-wp-admin