Presently there is an ongoing global attack on WordPress installations to crack admin accounts and inject malicious scripts. Once an admin account has been compromised malicious scripts are being uploaded into the directories.

This attack is taking place at a global level and since the attack is wide-ranging and most of the IP’s used are spoofed, it is difficult to block all malicious data.

To strengthen the security of your website(s) you should (if not already done):

• Update and upgrade your WordPress installation and all installed plugins etc. to the latest version.
• Consider installing a security plugin such as the Better WP Security plugin which you can find here.
• Ensure that your admin password is secure and contains a mix of upper and lower case letters, digits and symbols. NEVER, NEVER, NEVER use recognizable words, names, dates etc as passwords.
• Also make your admin password longer than the commonly-used eight characters.
• Use a user name other than the standard “Admin’.

The more technically minded and able could also consider the following:

• Remove README and license files which may expose version information.
• Move the wp-config.php file up one directory level and change its permission to 400.
• Restrict access to wp-admin only to specific IPs.
• Apply strong additional password protection to /admin directories.

Other ways of hardening a WordPress installation can be found at http://codex.wordpress.org/Hardening_WordPress

Some other useful plugins are wp-security-scan, wordpress-firewall, ms-user-management, wp-maintenance-mode, ultimate-security-scanner, wordfence.