When you include plugins and themes — which is a must because that is how WordPress gets used — the ecosystem as a whole is a security shitshow. Many popular plug-in vendors have abysmal security records. You don’t need to find a vuln in core WordPress to pwn installs.