The attackers were trying to download the wp-config.php WordPress configuration file which contains database credentials and connection info, besides authentication unique keys, and salts.

Certain configuration files containing database connection information, such as IIS’s web.config and WordPress’s wp-config.php, must reside in the web document tree but are protected by other ...

Attackers are using Eval PHP, an outdated legitimate WordPress plugin, to compromise websites by injecting stealthy backdoors.

Attackers tried to download configuration files from WordPress sites so they could steal database credentials.