Just a heads-up for any Wordpress users. I was hit by this on the 20th of June and just found out today (although it's been out a while). I've got quite a few WP sites, so I need to check over them all, but I think it just affected one.
I'm still reading through this lot to find out how it happened and what to do to fix it fully and stop it happening again.
WordPress › Support » Security issue, multiple sites