Can you access the server or host? You could roll back your site to a point prior to the issue, then work on patching the vulnerability by either removing the outdated plugin, or updating the plugin, and updating to the latest stable release of WordPress.
You could also work with your host or a 3rd party vulnerability scanner to identify what files are corrupted, and then remove those files directly from the file system. There are a number of services that can help with this – but if you are using a hosting company, they can often assist as well.
Apart from keeping your installation/environment up to date with the latest patches, consider using 2FA and strong passwords, and even a DNS tool to mitigate DDoS attacks, if that is a concern.