I had installed two WordPress sites on same server (Ubuntu + Nginx +Mariadb + php-fpm).
/var/www/html
/var/www/html2
Now problem is that file manager plugin installed on one WordPress site can read and edit files of another site.
Example: Plugin of WordPress at /var/www/html and edit files of /var/www/html2
Is there any way to restrict access of file manager plugin of one WordPress to installation_folder of that WordPress only?
The only way to do this is to run several php-fpm pools with different users specified in www.conf, one user per site. And lock users in their respective folders: /var/www/html, /var/www/html2, etc.
WordPress plugin has those access rights which php has. Php has those access rights, which user has, under which name it is executed.
It is a common problem, not related to any certain plugin. Now php code by itself has access to all sites, and if one site will become infected, then virus will copy itself to all sites on the server.
Finally solved the problem. As KAGG Design suggested, creating separate php process for each site fixed it.
In case anybody face same problem in future:- https://www.digitalocean.com/community/tutorials/how-to-host-multiple-websites-securely-with-nginx-and-php-fpm-on-ubuntu-14-04
