I've not your experience, neither never did go in deep with the core, but what I can tell: if the core is no good, then I'll will say nothing about the plugins.

I've not your experience, neither never did go in deep with the core, but what I can tell: if the core is no good, then I'll will say nothing about the plugins. Wordpress plugins, and the usage they get by (certain kind of) developers, have been my nightmare from the security and performance viewpoints, always I've been involved maintaining wordpress based solutions. Anyway, wordpress is not the only web application affected by a this kind of bug (serialization, user input, eval, etc) in the late times.