1

Regarding point 3 in this (awesome) article on mikejolley.com.

It states:

Never trust user input, even that provided by admin users, because:

  1. You have no way of knowing the user is whom they say they are.
  2. Other scripts can manipulate posted data.

I can understand that it's important to not trust all user input, since a user with a different role can have bad intentions.

But then talking about admin users, the first point kind of breaks the concept to me. If someone has managed to access the admin area by making it look like they are someone else, isn't it all over anyway? I mean, even when you escape and sanitise everything, couldn't the hacker just insert a backdoor by saving code in http://www.example.com/wp-admin/theme-editor.php?

How likely is it that someone unwanted infiltrates the WordPress admin area?

Exceptions:

  • Knowing the admin password with bad intentions
  • Brute force attack or some other attack that allows the attacker to login.
  • @Aravona, I'm not sure what you mean. Do you mean plugins using create_function or eval? Because post and pages always contain PHP (in their templates at least). – Tim Sep 24 '15 at 10:15
  • no I mean through a post or page when you're in the editor, but never mind I misread your actual final question :) – Aravona Sep 24 '15 at 10:18
1

If someone has managed to access the admin area by making it look like they are someone else, isn't it all over anyway?

This to me is more part of your exclusions as this is the main way anyone gains access through WordPress... So not really, if you have a backup, just drop the Database, upload your backup and change the passwords - then perhaps look into additional security. A good plan is to not name the admin as admin for example (doing this on one site prevented a lot of spam attempted logins for me with people attempting to guess the password)

How likely is it that someone unwanted infiltrates the WordPress admin area?

This depends on your set up really, what security plugins you have, or if you've manually set up any restricted access such as IP blocking for certain files. The more you put in the more they've got to deal with. Most of these are risk reduction techniques which help to prevent brute force, etc.

The only other thing I can think of is to keep your web server maintained, secure and up to date so that users cannot use vulnerability loopholes to gain access to your servers.

WordPress accept security reports so as a community the more that is brought to their attention, in theory, the more secure WordPress will become. To be honest, unless your website is popular, and getting regular spam, hits, etc, you're probably not going to be worth a hackers time.

  • 1
    Thanks, makes sense. So generally it should be enough to just follow all documented methods. – Tim Sep 24 '15 at 17:24
2

Okay, so an admin gets full-on hacked. You're screwed. No matter what. But what if it's a localised/specific XSS attack? What if the file editor is disabled on the system? What if the request is genuine but the admin has accidentally pasted a bunch of crap that's gonna bork your beautiful theme?

These are all scenarios you can protect against. Ultimately the argument will always be you have nothing to lose and everything to gain from correctly sanitizing and escaping.

  • I see, I've probably interpreted point one a bit too literally. I came to me as if this was an actual "known" technique. – Tim Sep 24 '15 at 17:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.