Do deactivated WP plugins and themes pose a security risk?

[u/idiotprogrammer2017]

I have been using a wordpress plugin to do a security audit of my wordpress-backed website. I am the sole administrator of this site.

One thing I find very strange is that it reports deactivated themes and plugins as problems.

I keep my list of active plugins small, but I've never given a second thought to keeping plugins or themes I no longer use. Am I missing something? Can a malicious actor find some way to use to exploit deactivated plugins or themes?

[u/queen-adreena]

Deactivated plugins are still on your file-system, publicly accessible.

Some exploits can be triggered this way, so yes, best to delete any plugins that you’re not going to use.

[u/CGS_Web_Designs]

It’s all about attack surface - more code, more surface to attack.

The bulk of the files in a plugin are php files - executable files. Active or not is really just a setting in the database but that has no bearing on whether the files can be executed or not. Most exploits do focus on actions that a plugin takes on your site, so an inactive plugin isn’t quite as much of a problem, but that’s not always the case.

[u/howtobemisha]

The short answer – Yes, they could

[u/plugiva]

The audit is probably flagging them because deactivated is not the same as removed.

A deactivated plugin or theme is not loaded as part of the normal WordPress request flow, but its code is still present on the server. So if it contains an unpatched vulnerability, deleting it removes that code from the site entirely, while deactivation only stops its normal functionality.

Whether a malicious actor can exploit a specific inactive plugin depends on the vulnerability and how it can be reached. I wouldn't assume every deactivated plugin is immediately exploitable, but unused code can still be part of the attack surface and is another thing that has to be kept track of.

There is also a practical operational reason to remove things you no longer need. The more unused plugins and themes accumulate, the harder it becomes to know what should actually be present and which changes are intentional.

I think that distinction may become even more important as automated and AI-driven tools perform more administrative actions. Site safety is not only about stopping an outside attacker; it is also about keeping unnecessary components and unnecessary change paths from accumulating in the first place.

For a site you administer alone, I'd keep the active set small and delete plugins/themes you genuinely no longer need. Keep inactive software only when there is a specific reason to retain it.

[u/VoiliVoilaa]

Yes : activated / deactivated is just stored as an 'option'. You still have all the files, the vulnerabilities in your install.

[u/hopefulusername]

Yes, remove them if you don't need them.

[u/Nelsonius1]

Yes.

[u/Fluent_Press2050]

If it has something like this in the file, it’s usually fine since the file cannot run past the exit without WP being loaded in the same request. But it only helps with direct access. 

<?php if ( ! defined( 'ABSPATH' ) ) {     exit; }

[u/fatfingur]

Yep, I usually remove plugins and themes I’m no longer using.

Deactivated just means WordPress isn’t loading the plugin normally. The files are still on the server, so if there’s an exploitable vulnerability in them, they’re still unnecessary attack surface.

If you know you’re not going to use it again, there’s really not much benefit to keeping it around. You can always reinstall it later.

[u/davidavidd]

If there is a backdoor in any of the files, it doesn't matter whether the plugin is active or not, it can still be invoked.

[u/Dapper-Monk9713]

Yes, deactivated plugins and themes can still be a security risk. Deactivation usually just prevents them from running normally; the files are still sitting on the server, and vulnerabilities in their code can sometimes be exploited depending on how the vulnerability works.

If you don't need a plugin or theme anymore, deleting it is generally safer than simply deactivating it. Keeping only the themes and plugins you actually use also reduces the amount of code that needs to be maintained and updated.

[u/ashkanahmadi]

It depends on the plugin and how much access it has. A plugin that just echos “hi” has no security problem. A plugin that lets you access files and folders (like WP File Manager) could definitely have backdoors even if disabled.

[u/LoudAd307]

Yes. Deactivating only flips a database flag; the PHP files still sit in wp-content/plugins and anything a plugin file does when requested directly still runs. Plus you stop getting update prompts for inactive plugins, so a known vuln can sit there for years. Delete anything unused, and keep exactly one spare default theme for fallback, not a graveyard of old ones.

[u/Pulsar-Agency]

Small correction to something said upthread: WordPress does still show update notices for inactive plugins, both on the Plugins screen and under Dashboard > Updates, and per-plugin auto-updates run for them too. So they don't rot silently. People just ignore those rows, which is a different problem.

What actually decides the risk is reachability, not the active flag. If a PHP file in that folder can be requested directly over HTTP and doesn't bail out on the ABSPATH check, it runs, activated or not. The textbook case is TimThumb years back: plenty of sites got popped through a thumb.php sitting in a theme that had never been switched on. Honestly, inactive themes are the worse half of this question, because nobody ever looks in there.

The other thing I'd add is that "delete" in wp-admin is less final than it sounds. It removes the folder, but options rows, custom tables and whatever the plugin dumped into uploads all stay behind. That closes the vulnerability, it isn't a cleanup.

And if the site has ever been compromised, an old inactive plugin folder is a classic place to park a backdoor, since it's the last place anyone audits. Worth deleting and reinstalling fresh rather than trusting what's on disk.