WordPress Incident Response - Backdoor & Credit-Card Skimmer Removal + Avada RCE Hardening

My WordPress site, running the Avada theme, has started acting strangely and deeper checks revealed both a backdoor and a credit-card skimmer hiding in the code. I have not made any recent updates or configuration changes, so the intrusion is likely exploiting an Avada-related RCE vulnerability... (Budget: £250 - £750 GBP, Jobs: cPanel, Firewall, Incident Response, Internet Security, PHP, phpMyAdmin, Security Auditing, Web Security, Website Optimization, WordPress)