Sign up ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have a little demo site (admin details are listed publicly), and I've configured the wp-config.php to disallow file edits, so in theory no one can install a theme / plugin.

define( 'DISALLOW_FILE_EDIT', true );
define( 'DISALLOW_FILE_MODS', true );

Yet lately I've noticed strange plugins & themes being installed on my demo site. I can see in the apache logs that they've been trying to access plugin-install.php but failing with a 500 error.

The folder permissions are 755 on both plugins & themes, so the files can execute but only the user has write access.

Does anyone know how they might be doing it / where I'm going wrong?


share|improve this question
If you would post a couple of the full log entries it would help. I suspect this is a bot trying to get access to the site-- just a guess. –  s_ha_dum Jan 28 '13 at 19:42
Seems my host only keeps the apache logs for a day :| –  user1958047 Jan 29 '13 at 11:51
Basically, requests were made to plugin-install.php and failing with 500 error... yet the plugins made it through. Could another plugin allow them to install a plugin on WordPress? –  user1958047 Jan 29 '13 at 11:53
Your description worries me, especially the part about the plugin making it through. It sounds like you have a security problem but I don't know that it can be solved in this venue. –  s_ha_dum Jan 29 '13 at 14:20
Perhaps your WordPress security are being overwritten from your cPanel or your panel (if not using cPanel). This sounds more like a problem with your hosting company. Why not contact them and explain the issue? –  denis.stoyanov Jul 28 at 8:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.