That's only speculation. All Wordfence found is that their site had a vulnerable plugin and they are magically linking that to the compromise. No real forensics there.