Remove Spam from Hacked WordPress

My WordPress site was recently compromised and is now littered with unsolicited spam posts and pages. I already tried rolling the site back from a backup, but the junk keeps re-appearing, so the infection is clearly still in the files or database.

What I need is a full cleanup and hardening job: locate every trace of the malicious code that is injecting these posts, scrub it from the core, plugins, themes, and database, and then patch any security holes so this doesn’t happen again. Once the site is clean, I also want the spam posts permanently removed and the legitimate content verified as intact.

To make sure the fix sticks, please document what you find, the steps you take, and any settings or tools you put in place (e.g. Wordfence, Sucuri, iThemes Security—your choice). I’ll supply cPanel, FTP, and wp-admin credentials as soon as we start. Looking for someone who can begin right away and finish with a secure, fully functional WordPress installation.