I wonder how the code looks like. Back in pre PHP5 days, it was surprisingly painful to read their docs (globals and side effects) and plugins source was just shocking. Angry 17yo levels of dirt loc (and that's insulting to 17yo)
Surprisingly pentesters i work with say the core is not too bad
The core is not too bad in the sense that it's stable, well-maintained, and mostly well-documented. The online code reference is also pretty great. The quality of the code is otherwise atrocious. Nobody should look at WordPress for any sort of guidance on what good code looks like.