@Terence -

With WordPress providing the SQL login and password in plain text in its wp-congfig.php is it any wonder why so many WordPress sites get hacked and WordPress gets the reputation for being difficult to impossible to make secure?

FUD. If true, every WordPress site in existence would be currently and constantly exploited. Also: the wp-config.php file can be moved elsewhere. The instructions are right in the Codex, along with plenty of other hardening suggestions.

@Yoro Nestoridis -

What I read here is complete nonsense.
Even updated WP sites get attacked and hacked; in fact, just look it up on Google and you will find WP hack-ware allowing any junkie to mess up your WP site.

More FUD. For the vast majority of compromised WordPress installs, the exploit vector was not WordPress, but rather compromised FTP credentials, or insecure shared-hosting configurations. For the sites for which WordPress itself was exploited, the issue has almost always been either an insecure Plugin, or an outdated version of WordPress. Nearly every WordPress release includes some sort of hardening, and usually such hardening is preventative. In 7 years of using WordPress, I can only remember a couple zero-day exploits being patched.