0

From the codex article on Must Use Plugins:

Can be enabled simply by uploading file to the mu-plugins directory, without having to log-in

This feels like a potential security problem to me. Regular plugins have to be activated via the admin panel before any code from the plugin runs on the site. I always thought this was a sensible security precaution because an attacker who was somehow able to upload a file to the plugins folder would also have to access and modify the database before he could get the code to run. The mu-plugins folder seems to provide a simple way to circumvent that.

I know the WordPress devs know a bit more about security than I do, so I was just wonder if someone could explain why this isn't a security hole.

Improve this question
1
  • 4
    This assumption is inherently wrong, if I can upload a file you're already in trouble mu-plugins or not. Activation means very little.
    – Wyck
    Jul 17, 2013 at 22:28

1 Answer 1

Reset to default
3

I agree with Wyck's comment. If I can upload files, game over. If I couldn't upload to mu-plugins chances are that I could upload, and overwrite, the theme's functions.php or Core files instead. Any of those options work as well or better than a mu-plugin file would.

The "also modify the database" part is irrelevant because if I can upload files modifying the database is trivial. Just run wp_insert_user or use $wpdb to run SQL to directly alter the database.

In other words, if I can upload files to the server I have already got more substantial control over the server than PHP is able to deal with, more control than PHP is able to put up a barrier against. The ability to upload to the server is a very substantial hack.

I don't know that activating plugins is so much security as it is convenience. The user can switch plugins on and off, and the developer can use activation and deactivation hooks to run special purpose code.

Improve this answer
2
  • Thanks for the explanation. Of course, simply uploading a file doesn't guarantee the web server will execute it in the WP environment where you can access $wpdb, but, as you say, replacing functions.php or a core file would easily accomplish that.
    – Dominic P
    Jul 17, 2013 at 23:02
  • No, it doesn't guarantee that you have access to WordPress functions but you should still have PHP's database functions and if you can write to the server there is pretty good chance you can read wp-config.php to get connection credentials (though again probably not with 100% certainty).
    – s_ha_dum
    Jul 17, 2013 at 23:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.