Seems to me like the perfect storm.
Vulnerable Wordpress Plugin
Bad Network design
Lacking proper firewall protection
Drupal vulnerability not patched
This was like a virgin honeypot surrounded by a hungry bee - a lesson to all
peter ogilvie
cellweb.co.uk