1

I am wondering what are the risks of a compromised Wordpress Admin account.

Can the Wordpress Admin user cause any risk to the platform running the wordpress? For example, can the admin gain access to OS or database? If on the same platform, other applications are being run, can the compromised admin cause any issue to other applications?

(I can imagine the hacker would have full control over the website content and look, users account, and can install new plugins that leave a backdoor to come back. But any other risk beyond the wordpress site itself?)

1

The short answer is that such a compromise would give an attacker the capability to do anything that an admin could do. That would likely include:

  • Altering theme files
  • Installing plugins
  • Accessing the (Wordpress) database

Etc.

Of course, the admin would have the ability to install malicious plugins/files (like a webshell) as well.

But any other risk beyond the wordpress site itself?

It's safe to assume "yes" - that there would be additional risk.

Without going into a huge amount of detail, the damage that could be done would be a product of:

  • Your webserver configuration (did you chroot your web files)?
  • The permissions with which the php executable runs
  • How prudent you've been setting file permissions throughout your server. Have you made any important files world-writeable?

Regarding that last point: of course, even if your "important" files aren't world writable, they may very well be world readable.

I'm not trying to self-promote here, but you might want to take a look at this webshell platform I made:

https://github.com/chrisallenlane/wash

I demo compromising a Wordpress application on YouTube. This gives you a pretty reasonable overview of the kind of trouble an attacker could cause:

https://www.youtube.com/watch?v=UPaUync0TVA

Please forgive the low-quality, monotonous video :)

TL;DR: if I had an admin account compromised, I personally would consider the entire system compromised and rebuild it from scratch, were that an option.

  • I guess if the Admin can upload any PHP file he wants, basically, he can do anything. So you are right, once hacked, must rebuild the entire shared environment. – Goli E Dec 30 '14 at 21:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.