[szszrk]

Is there any fairly popular software that still uses md5 in this context?

Most I've seen (sec scans, backup validation/dedup etc) pushed to phase out md5 very long time ago.

[h33t-l4x0r]

Wordpress uses md5 checksums for core files. That doesn't make it vulnerable to this, except in the sense that it kind of validates using them.