I have a little demo site (admin details are listed publicly), and I've configured the wp-config to disallow file edits, so in theory no one can install a theme / plugin.
Yet lately I've noticed strange plugins & themes being installed on my demo site. I can see in the apache logs that they've been trying to access plugin-install.php but failing with a 500 error.
The folder permissions are 755 on both plugins & themes, so the files can execute but only the user has write access.
Does anyone know how they might be doing it / where I'm going wrong?