Everyone's telling you the same thing right now: update WordPress. Which is, fine, yes, obviously but that's not enough. Patching closes the hole. What is someone is already In your system?
So let's actually walk through this properly what to do right now, what to do if you can't patch immediately, and what to do if you think you were already hit.
Need more context? I wrote a summarising one here.
S1: Stop assuming you're patched. Go check.
WordPress flipped on forced automatic background updates for this one because of how serious it is. That's great, except "forced" doesn't mean "guaranteed", VERIFY IT.
