Just from digging through the WordPress source, and knowing it's a frequent source of CVEs, I think it urgently needs large-scale refactoring and rewriting. If that can't be done because of how many things depend on it, is the backwards compatibility really worth the continuous stream of security problems? From one perspective it seems kind of wrong to be encouraging people to keep using a platform that is so broken at its core. When asked professionally I tell people to use WordPress.com or another reputable managed host or just avoid the product entirely.