Basically my friend has a custom wordpress site which was hacked recently but apparently the dev cleaned it up (said it was a server hack and that all their sites were hit) and filed a reconsideration request which was approved so i'm assuming it's fixed. But I noticed there are still spam pages floating around on the site.
In the wordpress back-end I can only see the published pages (less than 10) so the 100+ spam pages must still be hiding somewhere else. I've tried searching in the cpanel file manager to no avail.
Any ideas of what I can do to locate and delete hidden pages in the wordpress files? I can find many of them through the inner links on Search Console, but that's just the URLs - I don't know where I can go to actually find the files and delete them.