One of my wordpress blogs was hacked. Here is how you can avoid this:
1. Do not load plugins you do no need
2. Check New Plugin before you install
3. Update WordPress and plugins often
To find the hacked plugins look at Date Time Stamps
found bfwp on my site group docs assembly was hacked
more on elamb.org, thunderstated.com