I can't either install/remove plugins or update WordPress core(the options are gone). Also, I can't access the update pages.
I've checked the directory permissions and all look good there.
When scanning the site using Wordfence and it says it has malicious code. And the site is also blacklisted when checking with Sucuri sitecheck - https://sitecheck.sucuri.net/
Feel free to make any change to the site, as far as you can restore it back to original. It's also fine to re-install WordPress core files if required.