It’s this kind of thing (and also this) that makes me a little nervous to use a self-hosted WordPress install for my blog. I know there are things you can do (and I’m doing some of them), but WordPress is a big, juicy, target for malware.