https://www.asocialanimal.net/if-they-get-into-your-wordpress-can-they-execute-php-code/
If they get into your wordpress, can they execute php code?