
Vulnerabilities
WordPress Theme Vulnerabilities: Mechanics, Risks and Mitigation
Theme code executes with server privileges, meaning a single insecure template file can grant attackers full control over the database and file system.
Everything TechSec Observer has reported about wordpress security: 2 stories, newest first. Part of our Vulnerabilities coverage.

Theme code executes with server privileges, meaning a single insecure template file can grant attackers full control over the database and file system.

Most plugin flaws arise from trusting user input without validation, allowing attackers to execute arbitrary code or steal data silently.