As far as I know, no.

Can you explain?

Hmmm….the code in ‘greater than’ and ‘less than’ was stripped from my reply. It should be (without the symbols) :

FilesMatch “wp-admin/load-scripts\.php|wp-admin/load-styles\.php”
Order allow,deny
Deny from all
/FilesMatch

Without concatenation disabled, WordPress still attempts to use load-script.php and load-styles.php file. Maybe due to the cache in browser you still don’t have issues, or something else has disabled concatenation on your website (maybe you have some plugin that did that).

Order allow,deny
Deny from all

…but not added the option to disable concatenation and I have no problems with the admin area and the exploit no longer works when I test it.

Thanks again, I’ll make sure that I disable concatenation anyway…just to be sure!

Thanks for the comment Jon! If you don’t disable concatenation, WordPress will attempt to use it on the admin side, and pages loading will fail. Cache plugins usually work for the front end (not admin side), so concatenation options is not affecting them. I use WP Rocket plugin, and it works fine.

For this to work both .htaccess code and disabling of concatenation must be applied.