Was I hacked? Was I safe?

Recently I received a hit from Malaysia (as reported/discovered by statpress) – it contained what looks like a match to the “ekibastos attack” – i.e. statpress reported a hit on the url: /index.php?cat=999+UNION+SELECT+null,CONCAT(666,CHAR(58),user_pass,CHAR(58),666,CHAR(58)),null,null,null+FROM+wp_users+where+id=1/*

I went to my server and blacklisted their ip, and I downloaded and installed the “exploit scanner” plugin – it’s scan reporeted a bunch of stuff (all in files).

My question is, should I be especially concerned? Is there any other action that I shuld take/be prepared to take? Are there specific files that I should check for exploits inserted by a hacker?

I apologize if this is the wrong forum, but I’d appreciate any feedback/answer I receive.

Thanks for your time,
Long time wordpress user/fan.