This was not an easy one but I got it sorted. I don’t know how they got in but they placed several files. The last one was:

wp-lib.php stuck in the wp-content/plugins directory and had encrypted code or “obfuscated” code: