In many ways the extremely high frequency of Wordpress security updates completely works against them. Whenever a security update is released it is utterly tri

In many ways the extremely high frequency of Wordpress security updates completely works against them. Whenever a security update is released it is utterly trivial to do a diff against the previous package and get a vector to exploitable vulnerabilities in the previous version (in many cases the changelogs themselves are a good hint). The default Wordpress headers also make it easy to quickly tell which version of WP a site is running and whether it's worth attacking. I give Wordpress credit for the advances they've made in automating parts of the upgrade process - it's now one click from the dashboard and if you are a popular site there really is no excuse for running an out of date version. However it's not enough. Wordpress need to move to minor/major versions where minor versions, that consist of security updates, are automatically updated to when detected by a blog. (Major updates that feature changes likely to break plugins should still require user input).