Just cleaned out a friend’s site after being hacked w/ malware. My working thought is he was running an older ver of WP. Update! Update!