Site hacked, seeking advice

My wife did this site, https://www.toplawyercoach.com, for a client, who purchased the Mimbopro theme (since none of the ones available through WP suited her tastes). The site has been up since September, but this morning the client emails in a panic stating her site has been hacked. It was apparently posting to her FB feed as well.

In the hacked index.php was this:

##########################################################
# Small PHP Web Shell by DeViL iRaQ (c) 2008-2009 #
# +POST method #
# +MySQL Client+Dumper for DB and tables #
# +PHP eval in text format and html for phpinfo() example #
# Greetz: Hussin X, Iraqi Diver, GenX The HaCkeR Iraqi #
# IRAQ_JaGUaR, Xman_Aliraq, Red Virus, Ameer Elshouq #
# All My Friends #
# Just for fun ?? #
##########################################################

I’ve temporarily thrown up a “maintenance” page and was wondering what steps I should take next.

Thanks for reading in.