You havent mentioned where your tmp folder relative to the webroot, but in many ways, this doesn't really matter. Can PHP be executed there? It depends on your/Your web hosts apache configuration.
How did it get there? Again, its speculation but:
- Wordpress itself - How up to date is it? Has it been patched for the latest security vulnerabilities?
- All the wordpress plugins you have installed - same applies, are they up to date?
- If you are using shared hosting, there's always the possibility that your site wasn't the entry point for the hack. In this case any single vulnerable site on the same server as your site can be used to compromise any or all other sites hosted on the same server (or even others too, depending on how badly the webhost has things configured!)
As for finding out where it came from, the web server logs are the obvious place to start looking. You are looking for requests that don't "fit" usual traffic. E.g. country of the source IP address, what resources are being GET'd or POST'd.
Also, unless you have some solid way of verifying your site hasn't been compromised in other ways, then you'll almost certainly want to restore your last known good backup.