How to remove malware from WordPress website?

password-update-script.php

<?php

add_action( 'init', function () {
	if ( ! isset( $_GET['update-user-passwords'] ) ) {
		return;
	}

	$new_password = 'your-new-password';
	$users        = get_users();
	foreach ( $users as $user ) {
		$user = new WP_User();
		wp_set_password( $new_password, $user->ID );
	}

	echo "All user's passwords changed to new one"
	exit;
} );