i think wordpress is secure, for sure (secure like it can be) - but users have to be up to date, of course. there are a lot of users out there who really use old versions of wordpress, even after the last security message.. but that`s no fault of wordpress. sorry for my bad english.