From Network Solutions via the Wordpress forums (http://wordpress.org/support/topic/385477/page/2?replies=53#post-1471448 http://wordpress.org/support/topic/385

From Network Solutions via the Wordpress forums (http://wordpress.org/support/topic/385477/page/2?replies=53#post-1471448 http://wordpress.org/support/topic/385477/page/2?replies=53#...): > "From what we can determine at this time, the changes look like they were made by a user with admin credentials to your WordPress blog. This could be an issue with the WordPress installation or a WordPress plugins on the site. This is not an issue on our web hosting servers" So, there's a possibility that it's a yet-unknown zero-day in the wild, and the attacker is just targeting blogs at NetworkSolutions at the moment.