At the moment, spectator. But if someone else who stumbles upon this server and has other motives, they could be able to dig further and gain access to DB files.

Then we would be at risk since I assume that's where they store our user credentials needed to login to our website backend and make updates. Although, that will be least of our worries since we can simply reset the username/passwords that have accessed out sites since we have activity logs.