Hacking in an administrator role

Hi, last week my blog was hacked, when someone created an account with the name “root”, which I didn’t paid attention at that time. After a few days, this user inserted a JS in a widget that would open a malicious java applet, making my blog black-listed by google. I investigated and noticed that this “root” user had admin role.

Is it a known security issue?

thanks