3 ms·
That still leaves the wp-content directory and everything in it, including other plugins, writable by the web server. A malicious or compromised plugin can then
by kijin 14y ago
That still leaves the wp-content directory and everything in it, including other plugins, writable by the web server. A malicious or compromised plugin can then check whether some of the highly popular plugins are installed, and modify their files to compromise the whole site. You don't need access to WordPress's core files to inflict a huge amount of damage.
Some directories do need to be writable for caching and uploading purposes, but those are just data, and data is usually inert. It's dangerous to leave any executable file (*.php) writable by the web server.
- EvilLook 14y ago>That still leaves the wp-content directory and everything in it, including other plugins, writable by the web server. You don't have to have the wp-content directory writable by the web server. I certainly don't on the WordPress installs that I maintain. I also do not have FTP open and listening. Users can SSH/SFTP files up if they wish, but I don't let the web server write into the Wordpress area for specifically that reason.
- mschuster91 14y agoIt does not, read exactly what I've written above - there are three users in total: your ssh login-account, the (user-unique) PHP account (suphp or similar solution used for this) and the user-unique FTP account. So, if you set up the ACLs and permission bits correctly, the webserver has no write rights, only you and the FTP user have.