My concern is that upgrading now may not completely eliminate any malware that already exists in the system.
I’d still recommend setting up a new server and installing Discourse there for testing. If everything looks good, you can then migrate over and resolve the issue in one go.