WordPress Phishing Cleanup Needed

I’ve just finished a manual sweep of my WordPress installation and uncovered several hidden phishing pages. The job is straightforward but critical: locate every phishing file or URL on the server, remove or neutralise them without disturbing legitimate content, and explain the infection path so I can prevent a repeat.

The site runs the latest public WordPress core, but themes and a few plugins may be outdated. I have full cPanel, FTP/SFTP, and phpMyAdmin access ready as soon as we agree on the approach. Feel free to use tools such as Wordfence, Sucuri, WP-CLI, or your own scripts—whatever lets you trace all malicious payloads quickly and thoroughly.

Deliverables:
• Complete removal of every phishing page and any related malicious code.
• Documentation outlining what you found, where it lived, and the steps taken to clean it.
• Recommended hardening actions (file-permission tweaks, plugin updates, firewall rules, etc.) so I can keep the site clean going forward.
• Confirmation that the site passes a fresh security scan after cleanup.

I need someone who can start promptly; once the work is finished I’ll verify by running my own scans and checking Search Console. If everything is clean and stable for 48 hours, the task is done.