Assuming a theme is properly secured, how save is the WordPress admin?

Question

Regarding point 3 in this (awesome) article on mikejolley.com.

It states:

Never trust user input, even that provided by admin users, because:

1. You have no way of knowing the user is whom they say they are.
2. Other scripts can manipulate posted data.

I can understand that it's important to not trust all user input, since a user with a different role can have bad intentions.

But then talking about admin users, the first point kind of breaks the concept to me. If someone has managed to access the admin area by making it look like they are someone else, isn't it all over anyway? I mean, even when you escape and sanitise everything, couldn't the hacker just insert a backdoor by saving code in http://www.example.com/wp-admin/theme-editor.php?

How likely is it that someone unwanted infiltrates the WordPress admin area?

Exceptions:

• Knowing the admin password with bad intentions
• Brute force attack or some other attack that allows the attacker to login.

Answer 1

If someone has managed to access the admin area by making it look like they are someone else, isn't it all over anyway?

This to me is more part of your exclusions as this is the main way anyone gains access through WordPress... So not really, if you have a backup, just drop the Database, upload your backup and change the passwords - then perhaps look into additional security. A good plan is to not name the admin as admin for example (doing this on one site prevented a lot of spam attempted logins for me with people attempting to guess the password)

How likely is it that someone unwanted infiltrates the WordPress admin area?

This depends on your set up really, what security plugins you have, or if you've manually set up any restricted access such as IP blocking for certain files. The more you put in the more they've got to deal with. Most of these are risk reduction techniques which help to prevent brute force, etc.

The only other thing I can think of is to keep your web server maintained, secure and up to date so that users cannot use vulnerability loopholes to gain access to your servers.

WordPress accept security reports so as a community the more that is brought to their attention, in theory, the more secure WordPress will become. To be honest, unless your website is popular, and getting regular spam, hits, etc, you're probably not going to be worth a hackers time.

Answer 2

Okay, so an admin gets full-on hacked. You're screwed. No matter what. But what if it's a localised/specific XSS attack? What if the file editor is disabled on the system? What if the request is genuine but the admin has accidentally pasted a bunch of crap that's gonna bork your beautiful theme?

These are all scenarios you can protect against. Ultimately the argument will always be you have nothing to lose and everything to gain from correctly sanitizing and escaping.