Admin User creating attack

I am facing new admin user creation attack on one of my woocommerce site. The admin user are created with systemusers username and using [email protected] as email address. After creating the user admin and user are getting new user created email notifications. Anyone here face this same problem before??how I can protect my site from this attack???

When first time user created I found one vulnerable plugin on my site from wordfence scan I have deleted that plugin now and installed iTheme security pro version and enabled 2FA for admin users but after that still 5 times that user is creating on my site.