Can installing a plugin delete an entire theme directory?

Question

I installed a plugin named "Contact Form With Captcha" via the Admin's back-end, and as soon as I activated and configured it, my entire customized theme disappeared!

Because my last backup was from yesterday night, I ended up losing many precious hours of customizations... But before trying to re-do the work I lost, I need to know:

1. Do WordPress plugins have permissions to delete entire directories? (it's a Linux based host)
2. Is there a quality control process for plugins before they enter the WordPress official repository?

I am using the latest WordPress 3.3.1 version.

Update: After making sure that I have a backup of the most recent changes, I tried installing that "Contact Form With Captcha" plugin again and... it didn't delete anything! Moreover, it works beautifully. How the first installation lead to theme directory deletion will probably remain a mystery for me.

Answer 1

Do WordPress plugins have permissions to delete entire directories? (it's a Linux based host)

WordPress plugins have permissions to do anything WordPress itself can do. It's all just code. There's no permissions model or sandboxing of any kind with plugins.

Plugins and themes can do anything that PHP on your system can do.

Is there a quality control process for plugins before they enter the WordPress official repository?

Yes and no. Generally, we review new plugins for prevention of spam and obvious security problems and the like, but it's not an extensive review. If a plugin contained code to delete themes, and it is an error of some sort, it's unlikely that it would be immediately caught before being listed.

Most security problems and spam are generally noticed and kept out, if not before then after. Reports sent to [email protected] are investigated, but quite a lot of the reports sent are false or incorrect in some manner.

See, it's unlikely that your theme disappearing is intentional behavior by the plugin. So it's a bug in some fashion. Plugins are not extensively tested. There's 18,000+ of the things, after all. You have to trust the author of the plugin to some degree.

Or your problem may be unrelated to the plugin. Without specific details on how your theme was removed and the sequence of events and the code that causes it to occur... what you've presented is basically hearsay. "I did this and a bunch of bad stuff happened" doesn't mean that the stuff you did caused the bad stuff to happen. Events in computing systems rarely are cause-effect. Most often they are several minor factors among many interacting systems which lead to an unintended and unexpected result. The weirder the problem (and yours sounds pretty weird), the more likely this is to be the case.

So realistically, instead of questioning the process that led to the circumstances, first you need to be sure that the circumstances are not a special case. A contact form plugin that intentionally deleted themes would get reported pretty quick, no? In such a case the plugin would have been removed. So if it's unintentional, and it didn't happen to anybody else, then you'd have to basically prove that it's the plugin that did it instead of some strange and unusual combination of circumstances which nobody could have predicted. The problem would have to be repeatable. The code causing the problem would need to be identified, and then the problem could be fixed.

Answer 2

First of all , I am sorry for your loss..

Unfortunately the case you have describes , although extremely rare - is possible. in an imaginary scenario, a plugin´s naming scheme , together with bad function naming and bad folder structure, with a specified set of system variables - can cause such a case . but like i said - IMHO you have a better chance at winning the lottery than all those wrong parameters aligning...

Maybe something else happened , and you unknowingly deleted your theme file ? or mislocated it ? or moved it ?

But coming back to your original questions :

The answer to your first question is : yes, technically it IS possible, although not in a direct mode - and also depends on system variables (chmod changes, permissions) and which folder is it.

The answer to your second question: sadly no.

there is no real control mechanism in practice on the repository. there is not even a standard for plugins (yet) although I always say that one SHOULD be developed (and i am even willingto volunteer on developing it - along with a certification mechanisem of verified plugin that will observes some basic guidlines, like folder structures, uninstall process, after cleaning etc..).

The only pseudo - control is that of the users themselves.

My advice is always to not install plugins that are dubious. how can you know ? look at the download statistics, and comments of the plugins. Chances are , if 10,000 users have downloaded it - someone has checked the code for bugs .

I myself have once found a fraudulent Trojan link in a quite popular plugin. it was later removed from the repository, but sadly - it can always still be distributed from other sources...