Identify & Repair Wordpress Code Injection

I'm currently facing a troubling issue on my WordPress site - code injections happening on a weekly basis. Despite implementing rigorous measures such as using Cloudflare, Malcare, regularly updating WordPress and plugins, and switching to robust passwords, the problem persists. These illicit code modifications seem to target specific PHP files in the wp-includes folder. I am in urgent need of a WordPress specialist who can not only identify the root cause but also fix the issue.
Ideal freelancer for this job should possess:
- Strong understanding of WordPress and PHP
- Extensive experience in web security
- Knowledge in handling, preventing, and eradicating code injections.