Can a WordPress Plugin Break Your Site? What It Can Access

Yes. WordPress has no permission system for plugins. Once a plugin is active, its PHP code runs inside WordPress with the same access as WordPress itself: it can read and change any database table, write files the web server can write, send data to other servers and create administrator accounts. Roles and capabilities limit what people can do, not what plugins can do. The only real control is choosing which plugins you install, keeping them updated and removing the ones you do not need.

This surprises a lot of site owners, because phones and browser extensions ask for permission before they touch your camera or your data. WordPress plugins do not. There is no prompt that says “this contact form wants access to your orders table”. Installing and activating a plugin is the permission.

Capabilities belong to users, not plugins

WordPress does have a permission model, but it is for people. Each user has a role (Administrator, Editor, Author, Contributor, Subscriber, plus any roles a plugin such as WooCommerce adds), and each role carries capabilities such as edit_posts, manage_options or install_plugins. When you open a screen in wp-admin, WordPress checks whether your account has the capability that screen needs.

Plugins use this system too, but only to decide which users can see their settings pages or run their actions. A plugin does not ask WordPress for manage_options and wait to be granted it. Its code simply runs, on every page load where it is active, including for visitors who are not logged in. So a plugin “with too many permissions” is really one of three things:

• Badly written code that forgets to check who is asking, letting a logged-out visitor or a Subscriber trigger an action meant for admins. Most WordPress vulnerabilities you read about are this kind.
• Abandoned code that was fine years ago but is no longer fixed when a flaw is found.
• Malicious code, either from a pirated “nulled” copy of a paid plugin, or added to a genuine plugin after the developer’s account or update server was compromised.

In all three cases the plugin already has full access. What changes is whether someone outside can use that access.

What an active plugin can do

Any active plugin can, with ordinary WordPress functions:

• Read and change every database table, including users, orders, form entries and the password hashes in wp_users.
• Create, edit or delete users, including new administrators.
• Write, change or delete files anywhere the web server user can write, which on many hosts includes the whole wp-content folder.
• Send data to an outside server, or load scripts from one into your pages.
• Change other plugins’ settings and add code that runs on every request.

A deactivated plugin does not run, but its files stay on the server. Some plugins include PHP files that can be requested directly by URL, so a vulnerable file in an inactive plugin can still be a way in. Deleting is safer than deactivating.

A plugin review you can run yourself

You can do most of this from the Plugins screen. If you or your developer have WP-CLI access, the commands below are quicker and give you a list to keep.

1. List what is active. In wp-admin, go to Plugins > Installed Plugins and filter by Active. With WP-CLI:

   wp plugin list --status=active --fields=name,version,update,auto_update

   Also check wp plugin list --status=must-use. Must-use plugins in wp-content/mu-plugins run automatically and only appear under a separate “Must-Use” link on the Plugins screen, so they are easy to overlook.

2. Ask of each one: do we still use this? Plugins installed for a one-off job (an import, a migration, a page you deleted) are the usual leftovers. Tools > Site Health also warns when inactive plugins are installed.
3. Check its health on wordpress.org. Open the plugin’s page in the directory and look at “Last updated”, “Active installations” and “Tested up to”. A plugin that has not been updated in a long time, or that shows a notice saying it has been closed, needs a replacement. The directory closes plugins with unfixed security issues, so a closed plugin is a warning sign.
4. Look it up in a vulnerability database before you install anything new, and for anything you are unsure about. WPScan, Patchstack and Wordfence each publish a searchable list of known plugin vulnerabilities with the version that fixed each one.
5. Check files have not been changed. For plugins that come from wordpress.org, WP-CLI can compare your files with the official copy:

   wp plugin verify-checksums --all

   Paid plugins from other sites cannot be checked this way and will be reported as unverified, which is expected.

6. Delete what you do not need, update the rest. For plugins you trust and that are actively maintained, turn on automatic updates with the “Enable auto-updates” link in the Automatic Updates column. For plugins that run your checkout or bookings, many owners prefer to update by hand after testing on a staging copy.

Lock down the accounts as well

A flawed plugin is far more dangerous when an attacker can also log in. Two quick checks:

• Count your administrators. Go to Users > All Users and filter by Administrator, or run:

  wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

  Anyone who does not need to install plugins or change settings should be an Editor or Shop Manager instead. An admin account you do not recognise is a sign of a compromise, not a tidy-up job.

• Turn off the built-in file editor. Add this line to wp-config.php, above the line that says “That’s all, stop editing”:

  define( 'DISALLOW_FILE_EDIT', true );

  It removes the theme and plugin file editors from wp-admin, so a stolen admin login cannot be used to paste code into a plugin from the dashboard. There is a stronger setting, DISALLOW_FILE_MODS, that also blocks installing and updating plugins from wp-admin. Only use that one if updates are handled another way, or your plugins will quietly fall behind.

Things that do not limit plugin access

It is worth knowing what will not help, so you do not rely on it:

• Role editor plugins change what users can do. They do not restrict what other plugins’ code can do.
• Security plugins can scan files, block known bad requests and alert you to changes, which is useful. But a security plugin is itself a plugin running with the same access as every other one. It cannot put other plugins in a sandbox.
• Reading the plugin’s description. Nothing in the readme limits what the code does.

If you think a plugin has already been misused

Signs include administrator accounts nobody created, redirects to other sites, files in wp-content you do not recognise, or a host warning about outgoing spam. Do not just delete the plugin and carry on, because the code it ran may have left other files or users behind. Follow our step by step guide to fixing a hacked WordPress site, and if you are not sure yet, start with the signs your site has been hacked.

Most small business sites do not need someone reading plugin code. They need the review above done regularly, updates applied and tested, and someone watching for the warning signs. If you would rather not do it yourself, our care plans include plugin checks and updates handled for you.

Frequently asked questions

Can a WordPress plugin hack my site?

A plugin can do anything WordPress can do once it is active, so a malicious plugin, or a genuine one with a security flaw, can be used to take over the site. That is why the choice of plugins, and keeping them updated, matters more than any setting.

Is a plugin from wordpress.org safe?

Safer than a random download, but not guaranteed forever. New plugins are reviewed when they are submitted to the directory, and the directory’s guidelines say a plugin found to have security issues will be closed until they are fixed. Later updates are the developer’s responsibility, and flaws are still found in popular plugins. Keep them updated and remove ones that stop being maintained.

Do WordPress plugins ask for permissions?

No. There is no permission prompt for plugins. Capabilities such as manage_options apply to user accounts. An active plugin’s code runs with full access to the site’s database and files.

Should I deactivate or delete plugins I do not use?

Delete them. A deactivated plugin’s files stay on the server, and a vulnerable file can sometimes still be reached directly. Deleting from the Plugins screen can also remove the plugin’s settings, so note anything you might need before you delete it.

Are nulled or free copies of paid plugins safe?

No. A “nulled” plugin is a paid plugin with its licence check removed by someone else, and you have no way to know what else they changed. They also do not get updates. Buy from the developer or use a free alternative.