An interesting article discussing the common ways hackers can inject code into a clean wordpress site.

http://ottopress.com/2009/hacked-wordpress-backdoors/