I found Latest Exploit

I got email from my hosting providers

Dear Hosting Account ‘hidden‘ Owner,

This is an automated alert to inform you that we have detected a malicious attempt to access your account via http or ftp on our server ‘hidden‘.
Our security systems have blocked the upload of malicious file to the server and put it to the quarantine

‘[PHP Upload Exploit]’: public_html/hidden/wp-content/themes/twentyfifteen/404.php

‘[PHP Upload Exploit]’: public_html/hidden/wp-content/themes/twentyfifteen/archive.php