Most of the time, its a programming error.
And since you are using WordPress instead of writing your own code, you going to have to figure out on your own.
That is why I don't bother using a "content manager" because you don't know how well its written or not and a lot of them like WordPress have hack-able admin portals. I have a couple of plain html sites that I see hackers try to see if I have a WordPress or Drupal admin page in my web error log all the time. Since they track back to vpn connections only one can assume hackers or bot-net. I could spen the time and exploit the zero day in VPN and find out if they are real people on a different ip or the VPN was hacked, but its too much work for my curiosity.