Malware uploaded through Wordpress, or Wordpress plugin.

You must:
- Delete files uploaded by hacker
- Change MySQL password
- Change Wordpress password
- Change FTP password
- Update Wordpress
- Update all plugins and themes

Files uploaded by hacker:
wp-includes/cache_checkexpress.php5
wp-includes/cache_checkexpress.php.
wp-includes/cache_checkexpress.php
wp-includes/pomo/cache_checkexpress.php5
wp-includes/pomo/cache_checkexpress.php
wp-includes/pomo/cache_checkexpress.php.
wp-includes/theme-compat/cache_checkexpress.php5
wp-includes/theme-compat/cache_checkexpress.php.
wp-includes/fonts/cache_checkexpress.php.
wp-includes/fonts/cache_checkexpress.php
wp-content/plugins/easy-adsense-lite/EzTran.php