whooami on "My site was ambushed...need help figuring out how"

Without divulging the file name, I should say, that I just looked through my own mod_security logs, and see a different attempt at an RFI attack, pointed at a core file that lives inside wp-includes/

Interesting. Time to go test that.