~11,000 sites have been infected with malware that’s good at avoiding detection
arstechnica.com
It's not clear precisely how the WordPress sites become infected in the first place.