Я нашел вот это:

Directories should have permissions of 755. NEVER 777
All files should have permissions of 644.
If you do want to use the built-in editor, theme files should have permissions of 666.

http://www.tamba2.org.uk/wordpress/chmod/

Вот что пишет codex.wordpress.org
* / — the root Wordpress directory: all files should be writable only by your user account.
o EXCEPT .htaccess if you want WordPress to automatically generate rewrite rules for you
* /wp-admin/ — the WordPress administration area: all files should be writable only by your user account.
* /wp-includes/ — the bulk of WordPress application logic: all files should be writable only by your user account.
* /wp-images/ — image files used by WordPress: all files should be writable only by your user account.
* /wp-content/ — variable user-supplied content: intended by Developers to be completely writable by all (owner/user, group, and public).
o /wp-content/themes/ — theme files. If you want to use the built-in theme editor, all files need to be group writable. If you do not want to use the built-in theme editor, all files can be writable only by your user account
o /wp-content/plugins/ — plugin files: all files should be writable only by your user account.
o other directories under /wp-content/ should be documented by whatever plugin / theme requires them. Permissions may vary.

http://codex.wordpress.org/Hardening_WordPress