Just for clarification, this is NOT a Wordpress exploit, this is an issue with an external image resizing script timthumb.php which is used in many popular themes.
This...
find . -name timthumb.php
...should help.
$ grep -rH "(strpos (strtolower ($url_info" /path/to/wordpress
if you are auditing PHP code, strpos is good to look out for, since it is often misused such as the case here. strpos will evaluate to true is the needle is match anywhere in the haystack, so things like: if(strpos(strtolower($username), 'admin'))
will match username 'test.admin' etc.