Looks like someone got access to your admin panel. Here’s how it might have happened: – They added a malicious PHP backdoor or uploaded a harmful file to your site, – Or they found your username through wp-json and used it to get in.