Malware uploaded through weakness in WordPress.

You must:
- Delete files uploaded by hacker
- Change MySQL password
- Change FTP password
- Update WordPress to its latest version: http://wordpress.org/download/

Files uploaded by hacker:

wp-content/themes/twentythirteen/fonts/newsvyQ.php
wp-content/themes/twentytwelve/wp-pagenum.php
wp-content/themes/twentytwelve/wp-posts.php