In reply to trevellyan.

There are two types of problems that can occur with an update:

1 - pure coding error, basically code that errors all of the time, which would have been noted during proper testing, and

2 - environmental errors, where a combinations of version of wordpress, other plugins, OS, PHP, and the like come together to create errors for some.

3 - security errors, unchecked and unsecured file handling... etc

Generally, the problems in part 1 are the big ones. These are plugins and themes that error out directly when you use them. Because there is no real testing involved in rolling out a wordpress plugin, no testing suite against which they are run before public release, this is too often the case. I have downloaded and tested dozens of plugins from Wordpress that either failed the first time I tried them, or worse yet, failed after an upgrade on a production site. It's reached a point that I retain back copies of every plugin and theme because of these sorts of errors. Themes are generally worse than plugins, but it happens with both.

The part 2 issues are harder to deal with. One of the main ones I have to deal with is that I generally run the newer versions of things like PHP. Many plugin authors seem to be operating on fairly old versions of PHP, and sometimes are prone to using functions in PHP which are either being phased out or no longer work in newer versions. Deprecated functions and methods, both in wordpress and in the operating environment are big issues.

The third one is the biggest issue, and the one that I think wordpress can do a lot more to address. I think that wordpress needs to have a more strict standard when it comes to writing files, not allowing plugins to write their own files but rather requiring everything go through the wordpress API. That would mean in php, java, and all the rest all file writes would go through an API style interface rather than directly writing their own files. This would remove direct file writes from code, and would give a secondary layer of sanitizing of inputs before a file is written. While not perfect, it would certainly make it harder for hackers to turn plugins into security holes.

Plugins and Themes are big wide open security holes for the most part. Most downloaders never check the code on a theme, would never notice a built in hack or remote include that could harm their site. This isn't common, but with Wordpress being as popular as it is, this sort of hacking is inevitable.