Site hacked. Sub pages not showing correct content

I notified by my host IONOS that there where some malicious files on one of my sites. I’ve removed the malicious files.

The site would off been set to get security updates automatically so it should off been patched, all plugins where up to date. But I’ve now updated it to version 6.3.

IF go to the home page it’s shows what it is meant to
https://rockcakes.com/
but as soon as you navigate to any sub page
https://rockcakes.com/about
it shows a spam page

I deactivated all the plugins and still did the same thing.

If set permalinks to plan so URLS look like this https://rockcakes.com/?p=123 then the correct content?is displayed.

When I 1st logged in there was a admin USER that was not meant to be there so I removed that. I will change all passwords on other admin accounts.

These where the 2 malicious files IONOS told me about:
~/rockcakes.com/jpvih7.php
~/rockcakes.com/wp-admin/js/5piuwx.php

In the root of the site there was also fold called /sheets/ that was pretending to some sort of file manger form the readme file. I removed that to.

The page I need help with: [log in to see the link]