5

When you install a plugin in WordPress you can choose to activate or deactivate it.

Let's say you have a plugin of which the latest version is vulnerable to XSS for example and you're waiting for a security fix to be released. Should I disable or uninstall the plugin? What is recommended?

A plugin is just a bunch of PHP (and other) files and when it's installed, it's in a directory on the web server so if a function is called from the outside by an attacker, it will get executed no matter if the plugin is "active" or not. A mitigation from a WAF or some htaccess rules to deny access might be used to block access to the vulnerable files until they are updated to the new (safe) version.

It is better to uninstall the plugin and delete all the files, unless it's not possible to do so because it would alter the website too much and you don't want to give up to some functions.

  • If a file is on a system, it can probably be executed. It might not have quite as much access as it would when executed within Wordpress (e.g. it might not have DB access, if it uses Wordpress specific methods), but a malicious plugin would be able to use generic methods which would probably work. – Matthew Jun 22 '16 at 14:53
  • Define "inactive". If wordpress doesn't actively link to it but the file is still there, it can and will be found by bots specifically looking for its URL. – Shadur Jun 25 '16 at 13:48
  • yes also owasp.org/index.php/… recommends to remove those plugins. – Fabio Jun 25 '16 at 13:51
6

Depends on the plugin, they can be if there is say a PHP script that can be called directly (doesn't depend on wordpress code or includes the right statements to load the wordpress libraries it needs).

You can effectively attempt to block direct access to the files via htaccess/server configuration but there are ways around that. Removing it entirely is better in general after all you can't run a file that doesn't exist.

Ultimately it depends on the vulnerability and the script it's in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.