Indeed. I fully agreed on that statement, as a WordPress software developer. When you install ANY plugin or theme (actually all themes are plugins) for WordPress, you fully trust its author, because the person behind every plugin's/theme's has a 100% full control over your site. For example, the plugin's author can do everything with your database. E.g. the one need only one single line of PHP code to change your admin password.
If you ask me - "is that so easy? for real?" I say "yes". If you add this single line into the source code of any your plugin or theme, the side owner will be in trouble:
PHP:
wp_update_user(array('ID' => wp_get_current_user()->ID, 'user_login' => 'owned', 'user_pass' => 'try to guess ;)'));
BTW it (the code) uses a standard API function, described here:
https://developer.wordpress.org/reference/functions/wp_update_user/, so there is no super-duper black magic Voodoo in it. It's a 100% legit code. I spent about a half of a minute to write it for you...
So NEVER EVEN install so-called "nulled" plugins and themes. If you think they were hacked and became available for free because some good Robin Hood just wanted to help on your way of a freeloader... you are wrong. The script has been hacked and the one who will use it will be owned.
Let me sum it up. WordPress is extremely safe. I mean it's safe right out of the box. But if you use it with some plugins or themes you are not 100% sure with (e.g. "nulled" scripts from shady websites), you are in serious danger. It's like Nike sneakers - they are absolutely safe for your feet, till you decide shoot your legs with a gun...
