0

I just received a notification from the developers of the Wordfence security plugin of several vulnerabilities that exist in other popular Wordpress plugins. One example in this case is a mailchimp form plugin which is likely to be quite widely used.

I'm interested to know whether some plugin vulnerabilities can be exploited even if the plugin is inactive? (ie the plugin is present on a site, but currently not activated)

Improve this question

1 Answer 1

Reset to default
3

Yes, of course. If the PHP code in a file works when that file called separately, and if there is a vulnerability, it can be exploited.

There are two basic rules. They apply not only to WordPress, but to every web site:

  1. Use only code that you understand completely.
  2. Do not put unused code onto your server.
Improve this answer
1
  • 1
    Point taken, but if people used only the code they understood completely, then 99% of the web would have to be taken down. I won't claim tounderstand all of WordPress core completely - and a few years ago I hardly understood any of it and was blogging and hacking away quite happily.
    – CK MacLeod
    Jul 29, 2016 at 0:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.