I had a client who got hacked recently and I noticed that there were weird characters appearing on her site, like Â and Æ. It turns out that the hackers changed the blog\_charset to UTF-7 in the `wp_options` table in the database. I set it back to UTF-8, but I was wondering if during the time it was set to UTF-7, could that create any security vulnerabilities?

I did some searching and discovered there used to be a [WordPress UTF-7 vulnerability that was fixed in version 2.0.6](http://www.securiteam.com/exploits/5XP072AKAQ.html). We're running the most recent version of WordPress, so they couldn't have used that exploit, but are there any other exploits related to UTF-7? Really, is there any reason the hackers would change the blog\_charset other than to be a pain? I've been trying to determine how they got in and I'm wondering if this is connected somehow.