Dealing with a server compromise is a real nightmare. I hate to unfairly disparage any framework or CMS without good reason, but I've seen a fair amount of WordPress plugins and Joomla plugins and that sort of thing and tend to be of the opinion that it's risky to use them. There doesn't appear to be any kind of vetting process to make sure they don't have security holes and a great number of them seem to have intentional holes so that people can compromise them.
Is there a security vulnerability in WordPress itself? Possibly.
Without a doubt, the code appears to be an exploit. The question is HOW DID IT GET IN THERE? This question can be extremely difficult to answer. It should be apparent that you are still at risk if you don't close the hole.
I'd be willing to bet that your installation of WordPress requires that your web server have write permissions on at least some portion of your web directory (i.e., the folder from which your website's source code files are served) and that this exploit was installed either directly by a compromised plugin you are using or by a malicious user forming a carefully constructed request to some form or script in your system that has a security hole.
However it was put in there, it may not be the only exploit in your code. If I were you, I would try immediately to refresh my website with pristine code from a copy that I was CERTAIN was not compromised. Keeping such a copy is much easier if you use GIT or SVN to manage your source code. I would also consider searching my http access logs for any unusual words in that code (e.g., "mpqga0918"). If you find that value in your http access logs, it may give you a clue about how the hack was inserted into your code. Or you may not find any reference to it in your logs. If the file was uploaded via some kind of POST operation, I don't know if this text would be in your access log. If you can find the file modification date on the compromised file, you might be able to check the apache log for that specific time and see if there were any weird-looking requests around that time.
Because the hack was able to write one file, there's a very good chance other files could have been written (possibly by different hackers). I would immediately be distrustful of my PHP code and HTML and might even be distrustful of my system over all -- perhaps the exploit was accomplished via some SSH vector? Or FTP? Or was apache compromised?
The ideal situation would be to start with a fresh server that you are CERTAIN is not compromised (like a fresh installed OS, fully patched, etc.) and then load that up with a pristine copy of your uncompromised source code. You might also consider server-hardening actions like
iptables
fail2ban
* samhain
Most importantly, I would be very suspicious of WordPress itself but even more suspicious of plugins written by unqualified devs or possibly even malicious coders.
