This is what I tell people. Wordpress core is pretty secure. The problem is people who are using WP just install the core and then add in whatever plugins they

This is what I tell people. Wordpress core is pretty secure. The problem is people who are using WP just install the core and then add in whatever plugins they need to get what they want to site to do. Nobody ever sandboxes and tests their plugins, they just install them willy-nilly - which is like taking candy from a baby if you're a hacker. And its already happened last year: Thousands of sites running the WordPress content management system have been hacked by a prolific threat actor that exploited a recently patched vulnerability in a widely used plugin. The vulnerable plugin, known as tagDiv Composer, is a mandatory requirement for using two WordPress themes: Newspaper and Newsmag. The themes are available through the Theme Forest and Envato marketplaces and have more than 155,000 downloads. https://arstechnica.com/security/2023/10/thousands-of-wordpress-sites-have-been-hacked-through-tagdiv-plugin-vulnerability/ https://arstechnica.com/security/2023/10/thousands-of-wordpr...