Please refer to this article for explanations and recommendations :

https://www.zdnet.com/article/hackers-exploit-zero-day-in-wordpress-plugin-to-create-rogue-admin-accounts/