I discovered that my site has around 20 spam advertisements for online casinos. A malicious actor was able to create a user with instructor-level access, which has allowed them to create courses hidden on my WordPress site.

Luckily, I noticed it quickly, but this is a big problem.