Issue wordpress hacked problems

[Inma]

Server operating system version

wordpress, plesk logs

Plesk version and microupdate number

18.0.55

hello we have found a server which has in some wordpress admin users created with this date and some have been found in plugins installed by those administrators, I do not know where to start looking ... immunify tells me that everything is fine.

what logs do I check?

 

[Inma]

and how would you do a search of all the tables containing "users`"? so as not to go from database to database.


Thanks