WordPress has a history of almost embarrassing security vulnerabilities. To be fair, most PHP applications of that era have similar track records.

The newer versions have been _much_ better.