Hacked by Canadian Pharmacists

[MrColin]

I've been webmastering for a non-profit animal rescue for the last few years or so. We needed to have some pretty non-technical people have access to post content etc. to the site. I went with Wordpress and they still bitch that its too complicated but whatever. My problem is this:

How are they doing this and how do I stop it?

 

[MrColin]

It looks to be identical to the well known "Wordpress Pharma Hack" but I cant find any of the files or database strings associated with it. I went ahead and deleted the atahulpa theme wich I've long suspected is vulnerable to sqli attack. I also disabled FTP access and changed everybody's passwords.

site is back up but not as pretty as it was.