Some of these problems are inherent to PHP, but the WordPress team has decided to work with PHP, therefore the problems of PHP are also legitimate issues to rai

Some of these problems are inherent to PHP, but the WordPress team has decided to work with PHP, therefore the problems of PHP are also legitimate issues to raise with the WordPress team. That is to say, in accepting PHP as their language, the WordPress team must take responsibility for that choice, and that includes confronting the security risks that arise from the choice of language. Sam Ruby made this same point, and he said it much better than I can hope to (he is responding to Matt Mullenweg in the comments): "Those that contribute to PHP apparently feel the most pain concerning support of multiple versions. Yes, you can argue that they brought this upon themselves; but it is worth noting that at this point you are along for the ride. When I’m in similar circumstances, I tend to consider the karma implications of cursing the driver. In any case, some people who are along for the ride with WordPress happened to cross my path yesterday. Perhaps you are in a position where you can help them. To my eyes, I see a bug that was reported on WordPress 2.1, and the milestone on that defect is currently set to 2.3. Hopefully the users affected won’t have a tendency to kick, or scream, or rant too much." http://intertwingly.net/blog/2007/07/17/Popular-Sovereignty http://intertwingly.net/blog/2007/07/17/Popular-Sovereignty There is another way to look at this. Microsoft has faced 30 years of criticism of its decision to promote features rather than security, a problem that began with DOS and lasted at least until Vista showed up. That same type of criticism can and should be made against the WordPress team. They promote features to make the user experience pleasant, but their attitude towards security has been horrible. What can they do? They can automate the test that Siobhan Ambrose does in the above article linked to by this thread. At the very least, WordPress can search a theme for Base64, so that when you try to activate the theme, you get a warning: "These templates contain Base64, which may be masking malicious code. Do you wish to proceed?" Again, it was the choice of the WordPress team to use PHP, so they must take responsibility for the choice of language. As Sam Ruby said, "It is worth noting that at this point you are along for the ride. When I’m in similar circumstances, I tend to consider the karma implications of cursing the driver" More so, WordPress became popular because it was easy for designers to work with, and the WordPress team has certainly participated, and encouraged, the creation of a culture in which the promiscuous sharing of templates seems normal. It is irresponsible of the WordPress team to ignore the security issues that this raises.