In reply to Hashim Warren.

It's been that way as long as I can remember. It's really more a user problem than it is the software being insecure.

The WordPress team rolls out patches quickly, but how many sites have you come across with core out of date, 50 plugins installed, 45 of them active, 44 needing an update or no longer supported. That scenario is far more common than a well maintained site, unfortunately.

Add to that the people who insist on using MyWeakPassword1234 everywhere on the internet, multiply everything by WordPresses market share and sprinkle on dash of good old fashion ignorance and it's easy to see why WordPress is considered insecure.

It's funny really because keeping plugins up to date and using a unique, random password is about 90% of the battle. It's not WordPress that's insecure, it's the way people use it.