@DLE -

In the case of a theme, a well-respected theme in the WordPress theme repository had a backdoor in it that allowed the hacker to reroute my domain to a terrorist site. My copy of the theme was up-to-date, which made no difference at all, since the backdoor was purposefully implanted in the code, which passed every security test I ran it through. Only an adept and careful PHP coder may have been able to see the problem.

Did you report this Theme, I hope? If not, is the Theme still live in the repository?

Please report such findings! For Theme-related issues, you can email the Theme Reviewers mail list, and we will suspend the Theme. (Note: this list is public; if you need to divulge exploit/vulnerability specifics, please email security@wordpress.org.)

In the case of plugins, an orphaned plugin did not receive a needed code update, which allowed an exploit to occur. A different plugin used an unsafe process that was known to have problems. In both cases, these plugins passed all tests with flying colors. Both plugins were highly regarded and recommended by the most prominent WordPress aficionados.

Likewise: did you report these Plugins? If not, are they still live in the repository?

Please report such Plugin security issues to plugins@wordpress.org, and they will be dealt with immediately.

It may not be the case that WordPress itself is broken, but I would be hard pressed to state that the WordPress model is in good shape. If anything, the Open Source software ideal is fundamentally flawed in this regard, with too many failings to avoid problems. No matter how strong the core WordPress code may be, out-of-date, orphaned, and poorly written add-ons will forever be its Achilles heel. And that’s a serious problem for anyone who wants his or her site to be bulletproof. WordPress simply can’t deliver that promise.

FUD

Yes, it's true: WordPress itself cannot control nor protect you against code that you add to it.

The power and flexibility of WordPress derive from its extensible design. However, it's your software, installed on your server, extended by Themes/Plugins that you choose to install. You are responsible for those choices.

For those unable or unwilling to take responsibility for such choices, there are hosted/managed WordPress options available.