As someone who runs an enterprise WordPress host, Facebook aren’t that surprising - loads of large organisations use WordPress either within their marketing department, or as their “second CMS” (AEM is very often the primary). We’re still seeing adoption growing too.The ones that might surprise you are banks and other financial institutions :)

Ultimately, WordPress is as secure as any other piece of software, but the ecosystem is so large and varied that there’s a low bar for many add-on plugins. A lot of enterprises build their own plugins for that reason, rather than using the full power of the ecosystem.

(Disclaimer: I’m also a member of the WordPress security team, but not speaking on behalf of them.)

As a Meta employee, I consider this a victory against NIH :)

Why? Afaik all Microsoft blogs are hosted on WordPress too. Everyone uses WordPress.

Wordpress is pretty big in enterprise blog-like sites, with their WordPress VIP offering.