[cd34]

I suspected the same on a client's site that runs multiple wordpress installations that has used multiple free templates. In 5 of the cases, the templates included code in the header.php and sidebar.php that allowed specially crafted strings to allow remote execution. We weren't able to determine whether the modification was made prior to his template being installed or the result of someone having his admin password for a few of the blogs as he didn't have the original template file zips.