In reply to Jim Walker.

That's interesting, what you and Mika say. About a year ago for a few months I was seeing the same hack on multiple sites and nearly all of them were running an old version of WordPress.

I assume if people kept everything up to date and used strong passwords, hacked WordPress sites would be very uncommon. The tragic thing is that these two things are so easy to do.

Maybe WordPress core should email available theme and plugin updates to the administrator a la WP Updates Notifier. Something like that in conjunction with the automatic core security updates that we have now, built-in login attempt limiting and enforcement of strong passwords could prevent a whole lot of mischief (and the reputation of WordPress).