Find out who is uploading the file?

Question

WordPress

Tell me, please, is it possible to somehow find out how and in what way the file is uploaded to the hosting.
There is a site on Wordpress. Virus files constantly appear in the root of the site.
What they haven't done already.
There are plugins.
WordfenceScan
iThemes Security
Limit Login Attempts
Quttera Web Malware Scanner
Yes, they find virus files, but when they are already on the server.
The topic was shoveled, there seems to be nothing suspicious. How else can you find where this bullshit comes from ...