2

I have bought a WP theme from a huge provider (themeforest). But it has a lot of bugs. The support asked me to send my WP Admin Login/Password. What risk does this have?

I know the supportstaff will have full access to the WP installation, with the WP admin credentials. this is ok for me.

But what about the server this instances is running on? Are there any changes that they would theoretically get access to the server? This is a no-no. As the sever hosts a lot of confidential stuff.

My Guess: Most likely yes, they could get access? (As far as I can tell they could input some php code in the wp-code-editor that opens up a shell or reads some files in the system?) Or am I wrong?

thanks!

Improve this question
1
  • 1
    Ask them exactly what permissions they need and if they are acceptable to you, create a user with only those permissions. – Joseph Leedy Jun 29 '12 at 12:51
5

If you give the provider full admin, they can technically do anything to your server that PHP would be able to do (by using the editor part of a given theme to add whatever commands they like). PHP is capable of running command line scripts, just to name one scary permission they would inherit.

Depending on what user (on the server, not in your WordPress install) you have running page scripts, that could be complete control or just control of some web portions of your server. Either way, it would not be insignificant.

I can't think of anything beyond the theme editor that would put your server in danger, but if they are providing the theme, I would think they would need access to that in order to do much so I don't know that there's a good option for you to keep your server safe and give them what they're asking.

Improve this answer
1
  • 2
    They'll also have access to the plugin editor and can upload plugins. But there's not a lot they can do there, that they can't in the theme editor. In fact, there's not a lot they can't do in the theme editor. – Stephen Harris Jun 29 '12 at 16:00
1

in theory there is alot they can do to your site.

As said i would see what permissions they need and then create a user based around those said permission.

If the user has lots of sales, themes, and a good general member of the network i wouldn't be too worried about it as alot of the providers or producers of content work out bugs like that on themeforest.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.