For what it’s worth, at one point one of our employees windows machines got infected, and the moment he did $something with Wordpress it intercepted the HTTP post and injected malware in there.

So that’s how these things can go, the employee’s machine may have been infected which was then used to inject this.