Say for example an encrypted wallet has 5000 addresses already pre-generated in the keypool.
Can getnewaddress be called via RPC command without knowing the actual wallet password?
I envisage a shopping cart script which calls getnewaddress to provide a customer with an address to spend to. The shopping cart would know the RPC password, but not the wallet password. The shopping cart never needs to spend funds.
If the shopping cart was hacked, can bitcoin be stolen?
Check out Hierarchical Deterministic Wallets (BIP32) and eventually this blog-post to get a better understanding of the implications it brings.
There are many wallets today that have BIP32 implemented. Bitcoin Core is NOT one of them and should probably not be used for the wallet feature.
In the scenario you described, your webserver will provide new public addresses, but will also know the private keys to them. Therefore, if your webserver were hacked, the bitcoins could be spend from those addresses.
With BIP32 you can separate the information to create public keys from the information needed to create the corresponding private keys.
The information to generate the corresponding private keys can be kept in Cold Storage.
Yes.
This works. Wallet can stay locked and 5000 addresses will be generated. It is completely safe, even server is hacked.
After that you need to unlock the wallet so another 5000 addresses to be pre-generated. However, this step is not completely safe. Suppose server is hacked and someone got the password via key logger.
Another possibility is... when 5000 addresses are generated, you stop bitcoind and upload new wallet with new 5000 addresses.
