trying to fix up an exploited WordPress install for local PTA on awful cpanel shared hosting. It looks like maybe compromised plugin?