See: http://ninjafirewall.com/malware/index.php?threat=2014-12-18.01
Read: http://www.sentrix.com/soaksoak-wordpress-malware-deep-analysis/
See it work: http://worldbeyond.us/bwa2/wp-content/plugins/LayerSlider/static/codemirror/demo/preview.html
Site affected: http://killmalware.com/g12records.net/
Exploit nowhere related to SoakSoak but another exploit…read: http://seclists.org/fulldisclosure/2014/Nov/78
polonus