如果我在wordpress安装中创建文件夹，是否存在安全问题？

Question

I have the newest wordpress installed in "example.com".

If I create the folder "example.com/my-app/" and there run index.php which fetches data from mysql, but not from the wordpress database (different user, different db), is there a security issue?

And if someone hacks into my wordpress account can they read the php files in "my-app/"?

Answer 1

If I create the folder "example.com/my-app/" and there run index.php which fetches data from mysql, but not from the wordpress database (different user, different db), is there a security issue?

Not as such, no.

And if someone hacks into my wordpress account can they read the php files in "my-app/"?

I think so. As far as I know, in the default setting, Wordpress does not offer the possibility of entering PHP code that gets executed, but there are plugins for that, eg Exec-PHP .

Seeing as an administrator can install such a plugin (or simply write one themselves) you have to assume that it is in fact possible to read and write PHP files from within Wordpress if somebody gains access to the administrator account.