OK, this is an interesting one. One of my clients with an up-to-date, fully patched version of Wordpress, with correct permissions on all necessary files, and

OK, this is an interesting one. One of my clients with an up-to-date, fully patched version of Wordpress, with correct permissions on all necessary files, and nothing too funky in wp-admin or wp-content/plugins, has had their site infected twice. It's a different infection from the one in the article, but it was the same <script>...</script> code each time. The interesting thing is that the infection didn't do anything to the site logs, and while I can see plenty of failed attempts to break Wordpress in the logs, after hours of examination I can't find any successful attempts to break Wordpress in the logs. The client has multiple WP sites, but this is the only one they've had trouble with. It's also the only one hosted with GoDaddy. So, either: there's a 0-day Wordpress exploit in the wild that can somehow compromise a site without showing up as a suspicious GET or POST in the site logs, or, somehow, hosts are being compromised and sites are being infected through their host. At the moment, I'm kinda leaning towards the latter.