This doesn't seem like a "PHP coding quality" issue to me -- more like a trust issue, because the site admin opened the security hole by installing a WP plugin.

This doesn't seem like a "PHP coding quality" issue to me -- more like a trust issue, because the site admin opened the security hole by installing a WP plugin. That could happen in any language / framework / situation. It's rogue code that got trusted.