Dodgy links appeared on WP site

[AHarvey]

Hi all,

I've been checking backlinks and keywords on our work site and noticed about a week a go that MULBERRY BAG and other odd keywords have appeared on the site.

finally managed to find them at the bottom of the homepage:

http://www.viresourcing.co.uk/

Problem is, I have no idea how they got there or how to remove them, I've checked all the files from within wordpress but I can't see anything, and I don't have FTP/sql/server access

Any advice?

 

[AHarvey]

Well I've turned on Wordfence and deleted a user account I didn't recognise and despite the scan failing the urls have disappeared but webmaster tools are showing a load of urls on the site that I can't find in pages or posts:

/?2016-jun-6084.html
/?2016-jun-2548.html
/?2016-jun-6098.html
/?2016-jun-198.html
/?2016-jun-155.html
/?2016-jun-5449.html
/?2016-jun-6541.html

Problem is with the current setup I have no access to the database, FTP or any backend systems outside of what I can access from within Wordpress.

Having run iThemes Security I've increased what security I can through there.

 

[AHarvey]

It's just a custom theme they had made, no idea on the author.

It's causing issues with woocommerce though as it's not compatible