2

Is it possible to write a virus in a form of a WordPress plugin/theme?

Is it possible to:

  • steal user data?
  • damage existing WordPress installation?
  • (optionally) self-spread the virus?

Are there any existing cases of this kind of viruses?

Improve this question

2 Answers 2

Reset to default
4

When you write PHP code, you can do just about anything. So when you run the code of a plugin it can do just about anything as well.

  • It can query the database and get whatever info is there (which is why it's a good idea to store passwords as hashes.)
  • Since it can query the database, it can also delete anything in the database, ruining settings, turning off plugins etc.
  • Plugins can send out info the normal way, mail, http, so spreading a virus will be hard if the receiver has good protection.

Depending on your server setup, a plugin can take over your server. If you allow it, to download files that it can execute, it would be able to download any code, that it would be able to run in your server. If the user running the code has enough privileges, it can do stuff like changing the password effectively shutting you out of the server.

But all of this, will be easy to spot, so if a lot of people are using it, you should be safe to download and use it, since expert PHP developers, would have found out about it.

So short answer is, yes almost anything is possible, but the dangers are not that great. If you use popular pluings.

I think a bigger danger, would be that the plugin is poorly written, and will accidentally create a security risk, like not validating user provided data etc.

Improve this answer
2
  • This sounds to me like a nightmare and a big security flaw. I used to think that WordPress was made in such a way that every plugin has access to only it's tables. But as it turns out it has access to everything and huge potential of messing things up. I wonder how do so many people use it comfortably. Maybe they also don't know....
    – Xsmael
    Dec 22, 2020 at 8:42
  • Btw this was written 6years ago, is WordPress still functioning the same way?
    – Xsmael
    Dec 22, 2020 at 8:43
3

Yes. Yes. Yes.

All of these are not only possible, but also easily encountered in the wild. There had been whole waves of self-spreading WordPress malware for some older insecure versions.

Everything WordPress has access to - any theme or plugin has access as well. Stealing or ruining data is trivial for code running as WP extensions.

Improve this answer
2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.