What can an attacker do if he has access to my wp-config file?

wp-config.php is an important file of the WP installation. It acts as a bridge between the WP file system and the MySQL database. wp-config.php contains the database connection credentials. Apart from this, it can also be used for:

  • Defining the security keys.
  • To specify the database prefix.
  • To set the default language for your admin panel.

If you have been hacked I recommend looking at: https://codex.wordpress.org/FAQ_My_site_was_hacked