What is that?
An attacker will trick a victim to do a POST request to that file with the malicious code in the wproPreviewHTML variable. If that user has special permissions on your side e. g. because he is logged in, the attacker will be able to do anything, that use can do.
The forbidden error may be suspicious, too. Some malicious software tries to hide in the error document. As the error documents are usually outside the document root folder for the normal web pages, there is quite a high chance for such modifications to be unnoticed.
What to do now?
You need to setup your server from scratch, as you cannot know the complete impact of the manipulation. It is likely that there is a backdoor hidden somewhere. Do not copy any program files (including scripts and php files) from the compromised server to the new one.
Further more there are some malicious programs for desktop computers, which manipulate php files during upload via FTP or SFTP.