Assuming you find out that the problem is with pligg (seems likely, as you've said it's an old version, and I've never heard of it, so it's probably not got a lot of eyes looking for bugs in its code)...
You're going to be very limited. As damage control:
Look through the logs, figure out what happened (talk to experts if necessary), and patch up at least that hole. Ban the hacker's IPs using firewalls or webserver access control rules. As others have said, try to backport anything that fixes the attack vector, if you can track down their entry point, and find a bug fix for it in newer pligg versions. Whatever you can reasonably (or even with hard work) do to prevent that exact same thing happening again. BUT, I really wouldn't try to "update" your version by backporting all security fixes. That would be a nightmare.
You can run log analysers/active IDS systems to actively identify and ban hackers. Fail2ban, for instance, does this sort of thing.
- Get a pristine copy of the old pligg version you installed (a copy without your changes)
- Use a version control system like git to apply your changes on top, and git a diff of everything you've changed since the pristine version
- Get the latest version of pligg, and apply your diff to it. It probably won't work, but you'll only need to change the minimum to get it working. Consult the changelogs and particularly the upgrade notes for pligg, which should help you to port your code.
A better, more long-term solution:
Get away from pligg, since it seems to have failed you. Having to customise software so much that it's no longer upgradeable to new versions means that it's badly designed. Get better software to base your code on, making sure you can write clean, portable code in it that doesn't alter the code of the product. Upgrades should then be clean and compatible, barring any small and infrequent necessary changes that the product release notes explain.