PHP automatically scores a few demerit points in most circles, but it's not just any-old PHP. It's PHP that's evolved over the better part of a decade and is full of bad ideas that are now baked into the WordPress system permanently.

Like Drupal it's overgrown with weeds. You need to keep pruning to keep moving, or you'll be a victim of backwards compatibility. Just ask Microsoft about that, or those trying to clean up OpenSSL.

There are other systems that are far worse, but they're not as popular so they're irrelevant. Nobody cares about Movable Type any more, for example.

Perhaps because it's constantly hacked and used to spread malware.

i can't speak much about core codebase, but plugins in general written quite badly too often. These will have security issues, html/php/javascript/css spaghetti in one file. From what I understand - there is no vetting process to accept new developers, nor API forces developers write secure/readable code.

Actually, the entire LAMP stack is just a couple of notches below Wordpress, and Wordpress is a LAMP product. Could be Wordpress is just the most hated LAMP implementation...or because Wordpress is so hated they hate LAMP too.