I got hit with this, too, and I have a couple of questions.
Does WordPress issue security bulletins? It would be nice to have a central clearing house (with an RSS feed or e-mail list) for information on this kind of exploit, including exactly which versions are affected, and all the steps needed to a) close the vulnerability and b) repair the damage. Maybe this exists and I don’t know about it?
I *think* I’ve both closed the hole and repaired the damage (or most of it; still haven’t converted my pages back to pages), but I may have missed something.
Thanks!