Multiple Balada Injector campaigns have compromised and infected¬†over 17,000 WordPress sites using known flaws in premium theme plugins. […]

from https://www.bleepingcomputer.com/news/security/over-17-000-wordpress-sites-hacked-in-balada-injector-attacks-last-month/