I had a client who got hacked recently and I noticed that there were weird characters appearing on her site, like Â and Æ. It turns out that the hackers changed the blog_charset to UTF-7 in the
wp_options table in the database. I set it back to UTF-8, but I was wondering if during the time it was set to UTF-7, could that create any security vulnerabilities?
I did some searching and discovered there used to be a WordPress UTF-7 vulnerability that was fixed in version 2.0.6. We're running the most recent version of WordPress, so they couldn't have used that exploit, but are there any other exploits related to UTF-7? Really, is there any reason the hackers would change the blog_charset other than to be a pain? I've been trying to determine how they got in and I'm wondering if this is connected somehow.