When logging into the admin. Wordpress panel shows strange window. Is it a vulnerability?

Question

Information Security

When logging into the admin. The Wordpress panel got the wrong sign, and entered "wp=admin" instead of "wp-admin", which caused a strange interface with the ability to upload instead of the panel. What could it be?

Answer 1

It could be a web shell. Site in backup for forensics, restore the last backup in which this does not appear (we do backups, right?)

Answer 2

Yes. It looks like shell. Definitely, the site was hacked, which is a common occurrence for WP.