Comments on: How To: Create Backdoor Admin Access in WordPress

By: Tuomas Leppänen

Tuomas Leppänen — Thu, 29 Jul 2010 23:59:18 +0000

Hmm, tbh I’m using this code with clients that have not paid for work I have done to protect it in case they refuse to pay and change passwords. I can easily log in and disable blog until they pay.

By: Ed

Ed — Mon, 26 Apr 2010 12:21:22 +0000

I can see the good and the bad in this. Let’s say you are creating a design for a client, one you know will need support in the future. By adding this to your functions, you will always be able to have a login to access the account, even if they delete yours and forget how to add a new one.

The one note here is that it is the intention of the programmer that really matters. Sure you can add this as a backdoor hack to manipulate WordPress blogs. And lets face it, those with bad intentions most likely already know how to do this.

So for you that are arguing that this is bad, at least the average user can see how it is implemented and can look at the functions of a theme they are thinking of using so any suspicious code.

And for those claiming that you can encode this, that is yet another warning for the average user. If you look in the functions.php file and see a set of random characters, beware. This is encoded data that may do a number of things. I have seen code like this automatically add “spammy” links, and more. And yes, some of the themes with this sort of code are actually found at WordPress.org! (or at least were last time I looked)

Bottom line, if you use this code in your theme, you should disclose to the end user why it is there so they can decide for themselves. If as a user, you aren’t sure about a theme, don’t use it. If you see a random line of characters, know that something is encoded and beware.

By: Backdoor in Wordpress ganz easy | wordpress | XSBlog2.0beta

Backdoor in Wordpress ganz easy | wordpress | XSBlog2.0beta — Wed, 06 Jan 2010 11:19:07 +0000

[...] Benutzer in WordPress anlegt und diesem Administrator-Rechte zuweist, zeigt der Beitrag “How-To: Create Backdoor Admin Access in WordPress“. Der Code sitzt in der functions.php des Templates und wird durch einen speziellen Aufruf [...]

By: Brad

Brad — Wed, 30 Dec 2009 13:35:21 +0000

Nice to see this code snippet got some conversations going! There are definitely many different uses for this code, some good and some bad. Any theme or plugin could contain malicious code, so it’s always a good idea to review the code of any theme or plugin you plan on using if it’s not from a trusted source.

By: Leland

Leland — Wed, 30 Dec 2009 11:56:03 +0000

@Viper007Bond: Yeah, true. Thanks for the response. I guess it can come in handy for when you just have FTP access and no other way to login.

Also thanks Tommy for the response, that sounds like an interesting application as well.

By: Viper007Bond

Viper007Bond — Wed, 30 Dec 2009 11:52:36 +0000

@Leland: You have FTP access to a client’s blog but are unable to access their administration area (forgotten password and unknown e-mail address) or MySQL. The times you’d need this are rather slim though.

Regardless, it’s not like Brad just invented something new here. This is one of the least detrimental things one could do to your blog if they wanted to. A theme is like a plugin — I could use a theme to spam other blogs, give me access to the files on your server, etc. etc. etc.

By: Daniel

Daniel — Wed, 30 Dec 2009 04:30:50 +0000

but I see where you are coming from. That’s why I said don’t be evil

Prejudices, Brad? :)

As stated above, it may be very easy for theme creators to insert such code into themes. It can also be encoded and inserted somewhere randomly as just a line of text. Most users are illiterates so chances are they won’t even suspect it.

By: Tommy Vallier

Tommy Vallier — Wed, 30 Dec 2009 01:05:07 +0000

Keith,

Yeah – they could.

I’m using similar code via a plugin for clients. The plugin sits in the admin sidebar and acts, mostly, as a contact form. It sits there in case a client needs help with something. When they do, they click on the link in the sidebar and fill in the form to “call” us.

If there isn’t already a dedicated user for us, a button is also on that page with a reminder that it’s best to have us work under our own username, and that they can click the button to generate one for us.

By: Keith

Keith — Wed, 30 Dec 2009 00:20:07 +0000

It’s interesting.

I’m not a WP expert, but if a WordPress theme creator (Such as leland) inserted this code into a themes function.php file… couldn’t he gain access to any blog using the user/pass defined in that code?

Just wondering, as I said, I’m not WP expert.

By: Leland

Leland — Wed, 30 Dec 2009 00:09:29 +0000

Brad (or anyone), can you give a practical example of how setting up a backdoor like this could be used legitimately? To be honest, I can’t think of anything good coming out of it.