> Not really. Having the ability for a web process to write its to files which it then executes actually opens up whole new vulnerabilities. For example: one po

> Not really. Having the ability for a web process to write its to files which it then executes actually opens up whole new vulnerabilities. For example: one popular PHP exploit is writing a PHP file, then executing it on the remote system. Can't write a file? Can't execute the exploit. You're definitely correct, but there can be two different contexts to execute PHP; with differing permissions. If I was to rebuild how WordPress does it's autoupdating, I'd get rid of the god-awful HTTP "cron" crap, and have a proper PHP CLI that can do the updating, that runs on the server and is never exposed outside of it, and then WordPress itself, with the core outside the webroot and the uploads folder with zero executable permissions. Still not perfect, but it'd be a hell of a lot nicer than how it currently runs.