An SEO plugin update shipped a backdoor for 11 hours. Updating does not remove it.

Rank Math PRO 3.0.123, downloaded from the vendor's site between 15 October 20:02 UTC and 16 October 07:12 UTC, carried malware. Once activated it set up persistent access, contacted rank1cdn[.]com and, per the vendor, exposed database credentials and API keys. The clean release is 3.0.124; only PRO was hit, not the WordPress.org version.

You clicked update on a trusted plugin. That one click may have handed out your database password and every key the web server can read. And the backdoor rebuilds itself on page visits, so deactivating it changes nothing.