Backup the pages, fresh wp install, wp security like ringfence, setup robots.txt and .htaccess, use paid/premium themes/extensions only.
Hosting could also be a part of it, everything I do on my server needs i.p whitelisted and 2fa.
They're injecting code into something that's vulnerable and...