I want to build my sites with Wordpress files that can't be modified and dirs where new files can't be added. Static content with permission without possibilities to execute, that will served by another web server (can't execute php code).
Updates will be provide by change wordpress root, and update database.
I want to know what security brakes will stay? I am not talking about if there are linux kernel exploit, apache exploit. my question is only about Wordpress. What security brakes that attackers can use in Wordpress, where files and dirs are unmodified and all permissions (include database) are right?
For easy: Admin password was sniffed/whatever. And Attacker has it.
PS: Sorry for my English