I am creating a website with Wordpress 5.2 on a CentOS Linux 7.7.1908 node. PHP version is 7.x.

I have asked assistance to the creator of the theme that I am using. The creator asks me admin access to the WP console in order to see the issue I am encountering and solve it.

Can I trust giving WP Admin access to a stranger? Can this login be exploited for hacking the machine?

  • 2
    "Can I trust a random developer that I don't know?": No. "Can someone with admin rights do bad things on my machine?": Yes. – Kusalananda Jan 18 at 14:23
  • 1
    @Kusalananda - WP admin has no root access. Agree with your first answer. Your second question is beside the point. – Marco Faustinelli Jan 18 at 16:52
  • I didn't say anything about root access. See the accepted answer: "you've already allowed that developer to run arbitrary code on your machine". – Kusalananda Jan 18 at 17:03
  • 1
    @Kusalananda "execution of arbitrary code as whatever user Wordpress runs under": no mention to admin rights to the machine (aka root access ). – Marco Faustinelli Jan 18 at 17:52
  • 2
    Ok, so you mean that a malicious WP admin can't, for example, collect your user's private data (passwords etc.) and do most other things that ordinarily amounts to "hacking"? If the machine is a dedicated WP machine, then why would root access be even interesting when you have WP admin rights? – Kusalananda Jan 18 at 17:57

Admin access in Wordpress gives complete control over the Wordpress settings, content, users, etc. (including exporting it all, e.g., via a backup). I believe it also allows execution of arbitrary code as whatever user Wordpress runs under (likely the web server user), e.g., via installing a Wordpress extension.

I believe a Wordpress theme contains of PHP code, though. So (unless you carefully audited the theme) you've already allowed that developer to run arbitrary code on your machine. Of course, if this is a publicly-available theme, the risk is lower (as it isn't targeted at you and detection is more likely).

In a lot of cases, you can greatly reduce the risk by setting up a temporary Wordpress instance, e.g., with a VM. You set up the minimal necessary to see the problem. Do not copy over your data (so, e.g., your user database can't be compromised); do not re-use your existing site/domain (to prevent attacks on your users e.g., via JavaScript). You can set up strict firewall rules for the VM (on the hypervisor). After the developer is done, you delete the VM, so you don't even care if somehow the system was compromised. Potentially, you can just send the VM image to the developer, who can then reproduce the problem locally.

(If you're not confident of running a VM yourself, you can get one relatively cheaply from any of the many cloud providers.)


I wouldn't give any stranger access to admin.

You can use teamviewer or webex etc to allow him to look in without giving him complete access or exposing password

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.