since Wordpress gets hacked regularly...
This is really your opinion and has nothing to do with the situation other than your discussions with your client. WordPress is free, open source software, and their TOS points out that the software is licensed under the GNU General Public License, there is no liability implied in any regard, and you are on your own: https://wordpress.org/about/gpl/
The installation on the server is completely unusable and destroyed,
no backups etc. and the client wants me to rebuild the site exactly
like it was, without paying me again....Also it should be noted, that
I hosted the website for him
You may have some recourse against the web server company itself, if you are using a third-party webhost. Read the webhost's TOS regarding their backups, security and guarantees. Most absolve themselves of all liability, anyway, and require you to have your own backups.
If you were running your own server from home/office and administering it yourself, you are solely responsible. You are by default responsible for your own work and your own backups.
because he couldn't get around to host it himself....
You should have had him hosting the site to absolve you of hosting responsibility. Was this an oversight of yours or his? Yet another discussion to have with the client.
he clearly insisted from the beginning to use a widely known
vulnerable system ...
Again, mostly an opinion, unless you want to get an expert witness to outline the vulnerabilities of WordPress and hosting environments. The relationship between software on a server and the server itself and security is a tricky legal argument.
there was no contract for maintenance afterwards...
Of WordPress itself? There is no contract in the GPU, and WordPress's own security team urges updates ASAP.
Or a "contract for maintenance" of the website and hosting as a whole? What kind of written or verbal agreement did you have with the client?
Am I liable for the damage and do I have to rebuild the site free of
This all comes down to the agreement and/or contract you have with him, either verbal or written.
And this also depends on local and national contract laws where you are located - USA? - and in Austria.
The hackers have little to do with it, other than the back itself; I doubt you can catch them, even if they are liable. The hack may have even been by a "bot", software that scans the web looking for vulnerable sites, and as such will leave few traces.
You can always check the https://archive.org/web/ to see if you can salvage any content from the old site.
But, with no agreements in place - or very vague agreements and assurances - it sounds like you are the one liable, and you may simply have to rebuild the site or pay someone to do it, or refund the money. Getting a lawyer is an option, but it is your decision; there may be more money involved in a legal recourse than simply rebuilding the site or a refund.
Updated 11/15/16 in response to comments:
He said he wanted a website, I sent him an offer (development only,
without hosting, etc.. and without clauses for liability or anything)
and he agreed to that offer...
That's a (vague) contract for a website without hosting, yes; and you don't have details about who is responsible for backups and liability. It falls on you; you're doing the work for the client, and the client is not working for you.
My client wants me to build him a car (with a widely known insecure
lock for example) and then for the comfort parks it on my property
without paying or a contract that I'm liable and somebody breaks into
his car and trashes it, I don't think I'm responsible
That's an inaccurate metaphor, because you are using WordPress to "build the car", not from scratch from a pile of metal and plastic, and the WordPress GNU license says "open source" and "no liability assumed or implied." So if the door locks are defective, it's your fault for not knowing that and taking that into account.
And you are building it on your property (your own hosting) without an agreement to build it there or secure it there, rather than the client's webhost (where he/they would be responsible, or not responsible according to the webhost TOS and the server stack, probably a mix of open source/commercial software), which is breaking your own work agreement.
And, you still haven't said anything about your server where the hack took place. What was the state of software? Whose server? Yours? Did you own/maintain it? That's all your problem and liability. None of that liability is outlined in the agreement with the client.
What you're trying to do is blame WordPress and your failures at writing work agreements and failures to maintain data backups and your webserver for your legal (and ethical and financial) problems.
You have no argument with WordPress; it was your choice to work with a client who wanted to use it. You have some argument with the client because they didn't get their own hosting; but you didn't abide by your own agreement. Most of your arguments are with your own issues.
This is straying into legal advice territory, but: you can either give a refund, rebuild the site for free, or get a lawyer. Or you can ignore it all and possibly be sued.