Patched Is Not Clean: Why a WordPress Update Will Not Remove a Hack
An update stops new attacks. It does nothing about files an attacker already wrote to your server. If your site was patched late, here is how to find out whether someone got in first.
Read article