Server rescue

Hello - I have a server with OVH (Cpanel/WHM/Centos) which has been hacked. OVH have provided FTP/SSH access in rescue mode to fix issue. From my limited knowledge of logs and what they have given me several sites have been compromised with phishing exploits. Possibly access has been gained on server using an exploit in Wordpress?

I have several businesses websites hosted and peoples email accounts on server. I have some backups but some or all maybe damaged from this attack.

Anyone good with servers / fixing / restoring or may have to be new server? Please advise as I am stuck.