Question about code injections

Every now and then I notice code injections in some of the wordpress sites we host. Sometimes its just a line or two of gibberish at the top of existing files and sometimes its brand new files with names intended to make it look like something thats supposed to be there.

Sometimes I’ll see it in a plugin or a theme file. Yesterday I found one site that had new files full of hacked code all over the uploads folder. Occasionally I’ll even see files in the root directory that have been hacked, like config.php.

My question is how do hackers get access to these files? Did they just gain access to the WP-admin through guessing passwords or have they gained access to the FTP Username and Password for the site? I know you can access plugin and theme files from the editor in the dashboard, but I didn’t think you could edit things like wp-config.