So far, the vulnerable sites under these new attacks are those
    running WordPress plugins such as Insert PHP and Exec-PHP, which
    allow visitors to customize posts by inserting PHP-based code
    directly into them.

This is never a good idea. Don't allow your content admins to add executable code to a CMS!