Can I compromise my VPS security by hosting wordpress site owned by another person?

I've my personal VPS running ubuntu server 12.04 with standard AMP stack.

I want to give my client hosting. but I'm worried if I give the client wp hosting with wp-admin access that means he will be able to execute php code on my server. Being VPS that runs on single username, and apache www-data, could this lead to serious security breach?

I can chmod www-data only files that reside within uploads dir. Thus disabling extra plugins and access to theme file edits. But will that be enough?

Answer

I think the thing to keep in mind is that Wordpress, like any other popular software is often a target for attacks. The upshot is that you could have your permissions configured in the best possible way, but if an extension is installed, and 6 months later a vulnerability is found in it, then it wont be long before your server is compromised.

Unless you or your customer is prepared to diligently apply security updates, and thoroughly check all security aspects of your server on a regular basis, then you will almost certainly get compromised at some stage.

Im not saying its impossible, just worth deciding whether or not you want to risk your own VPS on it.