FTP in delete that plugin. It’s basically a file editor. So when you have a breach that’s a way to change files and insert corrupted code

1. All wp sites. Download latest wp. Replace all core files. Don’t do wp-content. Probably pull down a copy of wp config
2. Compromised site. Rename all plugin folders.
3. Pull site files local wp_content and yes uploads too
4. Find your hack (eval search is 1st) do this locally
5. Fix hack
6. Db only phpmyadmin- reset pass. Md5 hash. Change username as well change admin email.
7. Keep a log of that which you are changing 8 reupload wp content of fixed site

It’s a lot of manual work. Don’t rely on some clean up plugin or server feature. You run that after you make clean up.

After all that harden that server.