WordPress isn't that insecure. A lot of third-party (i.e. written by inexperienced developers) plugins for it are, though.