ResolvedDoes WordPress secretly add plugins in the background without my permission? I never agreed to that!

Normally, no. Either there's a plugin with a backdoor, in which case we recommend disabling automatic plugin updates, or the server has been compromised with injected code. You'll need to update and configure firewall rules, but the exact solution depends on the specific situation—get it checked by a professional website administrator.