Hmm, however unlikely, it seems that the hacker is aware of a 0-day in wordpress. Almost all of the websites compromised were using WordPress. Weird.