In reply to Terence Milbourn.

@otto

That argument would make much more sense, if there werent deep-seated security flaws in WordPress, caused by continued support of php 5.2.

Support of 5.2 is the reason that WordPress doesn't support real bound and prepared MySQL queries, and instead relies on sql_escape() and wpdb->prepare().

The entire 4.8.3 fiasco was caused by this decision, and these functions continue to be fundamentally insecure on all versions of PHP, just waiting for someone to work out a properly-structured exploit.