New wordpress vulnerability?

Question

Burglary protection

The user [email protected] registered on three WordPress sites within one night with a spread of several hours and received administrator rights.
And:
1. On all sites there were different versions of WordPress, on one the latest, on two - outdated for half a year.
2. All sites on one hosting.
3. FTP and phpmyadmin access to all sites has been closed.
4. User registration in WordPress was prohibited.
5. Hosting technical support did not detect brute force attempts, etc.
6. The sites have approximately the same set of plugins, but there were no problems with them before.
The question is in what direction to dig, how is this possible?

Answer 1

Where did you download templates for websites?

Answer 2

The guy had doors in the theme templates beforehand.