It was a wordpress plugin. I had to completely restore everything from remote backups onto a different server, then wipe my current server clean and transfer the backups onto the clean server after malware scanning.