> Therefore, they should be treated with the same level of caution that any powerful yet relatively unrestrained program deserves. A friend of mine's mother ro

> Therefore, they should be treated with the same level of caution that any powerful yet relatively unrestrained program deserves. A friend of mine's mother routinely compromises his vps simply by installing themes which include the popular TimThumb (https://code.google.com/p/timthumb/ https://code.google.com/p/timthumb/) plugin. Through the plugin, it's easy for an attacker to install web shells etc. This is true of many plugin systems, and RubyGems for example is not immune from this. The difference between installing a new gem however, is that as a software engineer or developer it's your job to have confidence in the security of the gem. With a Wordpress plugin, any user of Wordpress can easily install it, and sometimes it's the theme which includes the plugin.