I've been using WordPress since its first year of existence. In that time, despite the very best firewalling, testing for exploits, and employing all the recommended security hole plugs, several of my WordPress-based sites were hacked, sometimes multiple times. It has been a source of frustration.

That said, the problem has not been in WordPress itself but in plugins and themes.

In the case of a theme, a well-respected theme in the WordPress theme repository had a backdoor in it that allowed the hacker to reroute my domain to a terrorist site. My copy of the theme was up-to-date, which made no difference at all, since the backdoor was purposefully implanted in the code, which passed every security test I ran it through. Only an adept and careful PHP coder may have been able to see the problem.

In the case of plugins, an orphaned plugin did not receive a needed code update, which allowed an exploit to occur. A different plugin used an unsafe process that was known to have problems. In both cases, these plugins passed all tests with flying colors. Both plugins were highly regarded and recommended by the most prominent WordPress aficionados.

So while WordPress code itself never failed me, other software integral to it did. WordPress is only as strong as its weakest links, and despite my precautions, those links failed. It may not be the case that WordPress itself is broken, but I would be hard pressed to state that the Wordpress model is in good shape. If anything, the Open Source software ideal is fundamentally flawed in this regard, with too many failings to avoid problems. No matter how strong the core WordPress code may be, out-of-date, orphaned, and poorly written add-ons will forever be its Achilles heel. And that's a serious problem for anyone who wants his or her site to be bulletproof. WordPress simply can't deliver that promise.