3 ms·

> This does not mean that it's "inherently" insecure. It's a pretty strong indicator though.

• tmikaeld 10y ago
  No, the more developers the better is usually the case. Any app that is large and complex at it's core with a very wide API that is continuously expanded on and occasionally refactored will get new bugs and vulnerabilities along the way. Couple that with many developers that are exchanged now and then and you have a nice unavoidable mess to handle whether you want to or not. Also, a majority of the vulnerabilities are in abandoned and badly coded plugins: https://www.wpwhitesecurity.com/wordpress-security/statistics-highlight-main-source-wordpress-vulnerabilities/ https://www.wpwhitesecurity.com/wordpress-security/statistic... (2014)
• wyck 10y ago
  This is completely wrong. The more eyes you have on something, the more hackers attacking something combined with more pen testers and coders working on it, the more secure it is. You know what is insecure and makes for a great target..software developed by few people, updated infrequently by people who don't care. The exact opposite of WordPress.
• RandomInteger4 10y ago
  Not really. Sometimes you hear about the WordPress security vulnerabilities that are patched, but still exploited, and this is mostly a problem with people not keeping an eye on security updates. Combine that with the popularity that WordPress has drawing in people who know enough to program themes and plugins, but not enough to program said themes and plugins securely (avoiding simple SQLi and XSS) and you get the perception of an insecure system that WordPress has.
  • kyriakos 10y ago
    Also the blame falls on actual users not keeping plugins up to date or using one's from dodgy sources.