A spam injector hides in plain site within WordPress theme files.
Source: Threadpost