I've seen a site that has been attacked by uploading php scripts (presumably some sort of shell, or code that loads a shell) to Wordpress' wp-content/uploads directory. Usually this directory is used for user uploaded content like photos etc. This particular server was configured to then run the malicious scripts for any user on the Internet (with knowledge of the correct URL).
How does this work? How would the cracker get wordpress to place the php file in the uploads directory without a user account? I this just the infamous and inspecific "yeah, wordpress is not secure" type of problem?