While trying to secure a site (LAMP & WordPress) on a shared host that had been victim of a pharma hack; I was advising the site owner to follow wordpress' best practices from here http://codex.wordpress.org/Hardening_WordPress and there is this command for making files read-only for everyone except the owner
find /path/to/your/wordpress/install/ -type f -exec chmod 644 {} \;
But I ran <?php echo exec('whoami'); ?>
and discovered that the apache user is running as the same user that the site-owner has for SFTP. So Apache is running as the file owner.
This looks to me like a massive security issue because anything the site owner can do, Wordpress plugins could do!
Am I correct that this is something the host should fix? If they are resistant, what can I say to persuade them, and is this a big enough problem to warrant changing hosts?
update : For clarity I am talking about protecting the website from itself effectively. To stop holes in plugins being used to write/edit code on the server, if the webserver is running as the site owner, then plugins could be manipulated into installing arbitrary code and altering the .htaccess
update 2: when I said "security hole", I might have meant "vulnerability"