Hack Attack: plugin setting altered and the whole site went Italics

Hi,

I saw similar things happened before but my case might be a bit different.

Just after one night sleep, half of my site went italics in font. The intruder somehow wanted to alter the setting of a plugin as well. Now the plugin is recovered.

But still couldn’t figure out what caused the italics. Used WordFence to scan but didn’t see any change in the theme.

Any idea why this would happen? Thanks!