I have bought a WP theme from a huge provider (themeforest). But it has a lot of bugs. The support asked me to send my WP Admin Login/Password. What risk does this have?
I know the supportstaff will have full access to the WP installation, with the WP admin credentials. this is ok for me.
But what about the server this instances is running on? Are there any changes that they would theoretically get access to the server? This is a no-no. As the sever hosts a lot of confidential stuff.
My Guess: Most likely yes, they could get access? (As far as I can tell they could input some php code in the wp-code-editor that opens up a shell or reads some files in the system?) Or am I wrong?