Essentially i found out you can prevent one site which has a security hole from modifying/reading another site via "open_basedir".
However when i upload media files using wordpress i got the error
[error] 3048#0: *42070 FastCGI sent in stderr: "PHP Warning: file_exists(): open_basedir restriction in effect. File(/tmp/php51UUIj) is not within the allowed path(s): (/var/www/wordpress-site) in /var/www/wordpress-site/wp-includes/functions.php on line 2505
PHP Warning: file_exists(): open_basedir restriction in effect. File(/tmp//TheFile.tmp) is not within the allowed path(s): (/var/www/wordpress-site) in /var/www/wordpress-site/wp-includes/functions.php on line 2340
PHP Warning: touch(): open_basedir restriction in effect. File(/tmp/TheFile.tmp) is not within the allowed path(s): (/var/www/wordpress-site) in /var/www/wordpress-site/wp-admin/includes/file.php on line 177" while reading response header from upstream, client: 69.196.169.22, server: wordpress-site.com, request: "POST /wp-admin/async-upload.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php-fastcgi/php-fcgi.socket:", host: "wordpress-site.com", referrer: "http://wordpress-site.com/wp-admin/media-upload.php?post_id=245&"
Removing this line from nginx fixed it
fastcgi_param PHP_VALUE open_basedir=$document_root;
However thats because open_basedir is disabled and now a hole in one site can access data in another. Is it possible to have open_basedir and allow wordpress to move /tmp/somefile into its own site directory?