Danny is wrong - that worm has been in the wild since well before WP 2.8.4. It just hadn't caused a flurry of activity on the forums till recently.

I answered that "its a trick question" because WordPress is not secure. Nor is any other application. All software has vulnerabilities, all web apps are at risk. It's a simple fact of life that if there is any vulnerability black hats will find it and exploit it.

WordPress installs are also at risk from vulnerabilities in PHP, MySQL, the server OS, any server apps such as cPanel, phpMyAdmin, Horde or other mail apps.... the only way to have a 100% secure site is to not have one!
All WordPress users can do is to make their sites as secure as possible and make sure they have a recovery plan.