From the codex article on Must Use Plugins:
Can be enabled simply by uploading file to the mu-plugins directory, without having to log-in
This feels like a potential security problem to me. Regular plugins have to be activated via the admin panel before any code from the plugin runs on the site. I always thought this was a sensible security precaution because an attacker who was somehow able to upload a file to the plugins folder would also have to access and modify the database before he could get the code to run. The
mu-plugins folder seems to provide a simple way to circumvent that.
I know the WordPress devs know a bit more about security than I do, so I was just wonder if someone could explain why this isn't a security hole.