Is it possible to hack through a disabled wordpress plugin?

Question

Burglary protection

Is it enough to disable the vulnerable Wordpress plugin and wait for the update? Can't a site be hacked even through a disabled plugin?

Answer 1

If the plugin contains the "necessary" code, you can easily go through all the files, find out the contents of wp-config, get access to the database from there, etc.
And you can request such a "correct" file directly site.ru/wp-content/plugins/plugin-shell.php and there will be no difference whether it is enabled or not.

Answer 2

Rename the disabled plugin folder.