our theme doesn't have any malware as it's passed strong security reviews

You can download theme from themeforest and check it, you will see that there is no such code there.

wp_vcd is well known virus of wordpress. Usually, you can get it when you used any nulled plugins on site early (or use it now). Sometimes, it can be infected server, especially if you use shared hosting.

You can find info about this type of virus in google, the same as info how to clean site from malware 

HI

Wordfence has picked up some malicious code in the Rehub theme and I wanted to check if this is correct?

Please advise..

Many thanks