You weren't really hacked, you were exploited. Hacking is something you do to an intentional target, this was likely (99.9%) chance a drive by exploit.
If you're on shared hosting it may not have been your account that was the initial breach, but this is a good reminder to always keep your CMS software updated. There was a major TimThumb exploit this month that has been causing grief across the majority of CMS solutions and required immediate security updates a couple weeks back.
WordPress isn't any less secure than any other CMS but like everything it's in your host configuration and how on top of your game you are at keeping your software up to date. Exploit spiders crawl around looking for old versions with known exploits to auto-hack, that's just how life is and has been for the past decade.
There's a bunch of really easy things you can do to obfuscate your install from crawl spiders (which are very simplistic) but this is also a good lesson on why you should use specialists.
Here are some very basic tips:
1) Don't install WordPress into the root directory. Install into a subdirectory. Exploit spiders look for your files in root, not in root/subdirectory.
2) Hide your WordPress version, there's no reason to broadcast what version you're on.
3) Harden your login page.
4) Set up automatic database and file backups.
5) If you are using shared hosting, be sure you're using a shared host who knows what they're doing and has a history of working with WordPress.
6) Stay up to date, if there's a notification that an update is available -- update. Updates don't get pushed out because the devs are bored, there's a reason.
If you can't handle these things on your own you should hire someone
. This tips are somewhat universal I just happen to prefer WordPress to all other CMS.
