Anyone that have read Wordpress' source code should not be surprised that it is the most exploited piece of software on the web.
It was not created by programmers. It was created by web designers (hence its great visual design).
Wordpress was probably the only company that has migrated from Ruby to PHP (when they purchased Gravatar).