[rrreese]

>Quick judgments

I think most peoples judgments have been formed over 21 years. WordPress initially gained a reputation for being a fast and easy way to setup a website, then gained a reputation for being a security nightmare.

Maybe its not anymore but people are right to be sceptical. I sure do see a lot of CVEs in the weekly update I check - maybe they're all low risk, or relate to rarely used plugins.

[kunley]

I think the root of bad reputation was due to various plugins and their usage pattern:

lots of non-tech users heard that they can use plugins X Y Z for fun and profit, so they started to use them, but no one told them that managing dependencies requires some skill or at least discipline; that the fact some 3rd party pluggable software exists doesn't automatically mean it's good, viable, maintainable and safe; and that things in IT don't work by means of cargo cult, copy-pasting without underdstanding and by crossing fingers. So, there was a fallacy: these people believed (and many believe until this day) that they can remain being non-tech users while maintaining their wordpress-with-plugins installation, but it's impossible; one needs to become tech-aware in the process.

I am not sure what WP community did to dissolve this fallacy; maybe they did something. maybe didn't.

[photomatt]

We've expanded our HackerOne and other security apparatus to cover the top 100 plugins directly and do our best to work with every plugin in the directory, including many contributions from web hosts who of course want their sites to be secure. The update system has become very robust, and all the top hosts also protect their sites at the network layer so many CVEs are blocked even if the code hasn't been updated yet.

[Tijdreiziger]

Personally (and this is just based on my gut feeling), I don’t think WP core is more insecure than other CMSes.

The real problem is the plugin ecosystem, which is not impossible to navigate for the disciplined, but at times bears resemblances to the Wild West.

So, what ends up happening is:

1. Cheap ’experts’ install every plugin under the sun.

2. One of these plugins inevitably gets pwned.

3. Headline: ‘WordPress backdoored’.