Something a lot like this. It seems that the point of entry was TinyMCE. It serves me right for languishing on such an old version of WordPress for so long.

I don’t know exactly how this site was being exploited but I hope that nothing malicious happened to any of my two to three visitors. You’re all reading on RSS these days, right? Anyway, I blew away the installs and got latest versions which (fingers crossed) have these vulnerabilities closed. I’m still in the process of bringing the DB entries over. Turns out there’s been a few schema changes since 2.0.3. So there may be some weirdness in the mean time.
More >