I18N Gallery

[mvlcek]

@mvclek: from the looks of it you're analyzing what happened. Did they do it via your plugin or via another way?

All the log entries sent by devaintfire show calls to files that should not be there, i.e. have been uploaded by means unknown. One of these files is a PHP file allowing script injection, but this does not mean that that file itself was uploaded by script injection.

To properly analyze this, the log entries before the access to the uploaded directories/files would be needed.
I suggest to move this to a separate topic, as with the information received so far the problem could be anywhere including the hoster's infrastructure (suggesting to turn allow_url_include off does not indicate a really safe infrastructure as this should be turned off by default).