Compromised wordpress installation

Recently, my installation of WordPress has been compromised. The attackers defaced the index.php file in my themes folder, and potentially done some other damaged to the wordpress engine as well.

For the past few days, I’ve been communicating with my webhost for the problem of the attack. They maintained that their server was not compromised, and that the attackers managed to gain access into my account through a flaw with wordpress, as they claim they have other users facing similar issue.

Looking at the raw access log of the server, I can see an IP address originating from Latvia (highly suspicious!!!) attempting to access the file wp-login.php …

It was accessed around the same time that the compromise took place. No other files was accessed.

I would like to know if anyone else has encountered similar incident, and if it’s even possible for attackers to modify the themes just only by accessing the wp-login.php file.