As to the worries about the community keeping their cool, I’m more worried about the potential harm that could always be done by a malicious coder.

Still, it is interesting that few instances have appeared like this. There are a few plugin providers, however, that *have* put self-serving code in their offerings. Not so much malicious, as they were invisible and not revealed on the developer’s download/FAQ pages.

Surely you all realize this is nothing new what so ever and every “plugin” across every application / web app has had this exact same possibility?

Come on folks. Nobody can protect you from yourself. “Don’t download suspicious plug-ins from suspicious places.” is the obvious solution.

And about your question, I donīt really understand it, or I donīt want to understand it maybe, it scares me a little. I canīt tell if this is theorical or somebody is doing it right now and nobody knows about it. How can we know?

Do you remember Sub7? the trojan horse, the owner wrote some code inside the application so it can search for a specific ICQ number and if the application was installed in a computer that has that ICQ profile installed, the Sub7 was made to destroy that computer using the “Hard Disk Killer” progam.

I donīt know, the sky is the limit for a person with PHP skills, if you let it enter to your server, giving him read, write, erase and execution permission.

This could panic the entire community, I hope everybody can keep it cool.

Regards!

Thank you very much for this clear example of weakness. Is there a way you can advice Wordpress developers about how can we protect agains malicious plugins?

Somebody should do a Anti-malicious Plugin, that protects our information from going out to an external source or e-mail.

Regards!