Is this a WordPress security bug?

Question

<?php
if ( ! is_admin() ) return;
echo 'You should not see this if you\'re not logged in!';
?>

If you put this in a mu-plugin, and go to your admin, e.g., example.com/wp-admin/ while you are not logged in, should you be able to see the echo?

Answer 1

You're misinterpreting the is_admin() function. It's not a tag to check whether or not the user is an admin, it's a template tag to check if you're on an admin page.

From the Codex:

This Conditional Tag checks if the Dashboard or the administration panel is being displayed. This is a boolean function, meaning it returns either TRUE or FALSE.

You're facing a couple of issued here though.

1. If you attempt to go to /wp-admin while you're not logged in, WordPress will automatically redirect the page. A request to /wp-admin is really a request to /wp-admin/index.php, a page non-logged-in users don't have permission to see in the first place. So you'll be redirected to /wp-admin/wp-login.php which doesn't necessarily load your plugin code.
2. I say "doesn't necessarily load your plugin code" because I'm not sure. From the looks of things you're echo/return exists in the global scope. Really, this code should be wrapped in a function and hooked to a WordPress action.

Now, if you go to the /wp-admin page while you're logged in, is_admin() will evaluate to true you should be able to see the content of your echo statement just fine, assuming a couple of things:

1. No errors in your code (as both @amit and @Fraggy have pointed out, you have a typo - an unescaped ' character.
2. That you're hooking things in at the right place. You shouldn't just echo and return in the global scope because, really, there's no way to control where that echo/return will be happening. You should place this code in a function.

Important Note

If you ever do find a security hole or security-related bug in WordPress, you should report it to [email protected] rather than posting in a public forum like this. This kind of responsible disclosure gives the team the chance to address and patch the issue before malicious hackers can read about it and exploit it.

Answer 2

The is_admin() only checks for if current visitor is on admin page or not.

To block any non admin user from visting any admin page use current_user_can(); function. Here's an example to check if current user is not a admin.

if ( ! current_user_can( 'manage_options' ) ) {
    echo 'You should not see this if you\'re not logged in!';
}

#1 Update -

is_user_logged_in() - There's a function to check if current visiting user is logged in or not, You can use that. Here's an updated example -

if ( ! is_user_logged_in() ) {
   echo 'You should not see this if you\'re not logged in';
}