Maldet is an awesome open-source linux program that searches a directory for malware signatures. http://www.rfxn.com/projects/linux-malware-detect/

I've used it dozens of times successfully, and with WordPress sites, it's usually a PHP backdoor uploaded into wp-content/uploads, and then compressed JS added into a file somewhere. Run it with -a.

Good luck!