Er Qi Yang

Thanks Sam for the links. I certainly am going to read through them a few more times to ensure no such repeat. I am still wary of other means of security flaw, for example, stolen password through key logger, and am thinking of the possibility of using Google to authenticate admin access to my blog, since Google has the 2-steps authentication. Anyone has any experience on that?

wearetoysoldiers: I am not exactly sure you call that lucky, though I can imagine if a index.php file has been placed in all my folders, I will be wanting to do a clean re-install. Thankfully, my data is pretty mobile with the export/import function, and a couple hours downtime should do the trick.