First off change your password immediately then make sure you have upgraded WordPress to the latest version and the same with all your plugins and your theme. If you are using a free theme and plugins that havn’t been updated by their authors for a long time they to may contain vulnerabilities.
Use the WordPress security plugin called “Wordfence”. It will scan your site file by file and hopefully detect the intrusion. If the intruder has hacked into your database then you will need some expert help.
If you view the Pages Not Found tab in your Wordfence admin area you will see how these hackers randomly search the internet for WordPress sites that have certain themes and plugins that obviously have vulnerabilities.