How people inject malicious code on my webpage?

we have several web pages and one of them (Wordpress one) have been infected with a malicious malware code injected on it. The code had created a redirect to ads page. It has his own user and downloads plugins and themes. We have already deleted it, but I was thinking.... If I have the forms with the correct security, how could be possible to inject this in a web page? I've searched, but normally people talk about how fix it, not how it happened, for future prevents it. Some suggestions?