Yea SQLi seems very likely and I’ve done some all-round hardening, thanks for the advise
The plugin isn’t picking up any malware, but my site’s usernames all periodically get changed to dexter. Where do I start looking?