It seems as if the vulnerability is in Wordpress' rpc.php file.<p><a href="http://www.wickedfire.com/shooting-shit/82271-shoemoney-com-hacked.html" rel="nofollow">http://www.wickedfire.com/shooting-shit/82271-shoemoney-com-...</a>