WordPress Malware Removal & Hardening

My small WordPress site has suddenly started burning through huge amounts of bandwidth, and my host believes something malicious is running from inside the installation. I have not changed passwords, installed any security plugins, or taken any other protective steps yet, so the site is still in the exact state where the problem can be reproduced.

Key facts you should know
• WordPress is on the latest version.
• One file, dated 05-22-25, looks suspicious according to the host.
• I need complete malware removal first, then hardening to keep this from happening again.

Here’s what I need delivered:
• Locate and remove every malicious file, script, or hidden task.
• Verify the site loads normally and bandwidth returns to expected levels.
• Provide a short report detailing what was found, what was removed, and any vulnerable settings you corrected.
• Recommend (and if possible, implement) basic hardening steps such as updated passwords, security plugin setup, and server-side rules.

Once the site is clean and secure I’ll take it from there, but I need your expertise to get it back to a safe baseline quickly.