Audit Log says that a user

While I was sleeping, according to my sucuri plugin audit log, a user account was created and successfully logged into my website riteoak.com. While they were logged in, they made some changes to plugins, requested a new sucuri API, uploaded a plugin called MiwoSQL. I blocked the user, and the ip address of that user, ran a malware scan which came out clean, but I’m not really sure what other precautions to take next. I’m worried that the user that broke into my wordpress website put in a script or SQL using the MiwoSQL plugin that allows for them to have unlimited access. Here is a screenshot of their activity: https://imgur.com/a/i6X1V
Does anyone have any suggestions? Thank you.

The page I need help with: [log in to see the link]