I avoided making any value judgement on purpose - you can't really do that off-the-cuff. Looking at the reports (linked here, [0]) it concerns hash checks on serialised widgets. The apparent vulnerability was reported by the Wordpress security team and reported as being hard to actually make work - I can't find a PoC or any actual exploit reports. It seems based on [1] that a fix was submitted 2 months before the report and made available to automatic updaters a few days prior (? I'm not sure how the reporting dates and such work here really, on a superficial view that's right though the bug is 2014-08-13 and the fix 2014-06-08 with the report of the update [2] coming 2014-08-06). So, whilst yes an arbitrary code execution is severe one that is fixed before it's made public and without any clear way to exploit it is perhaps less of an issue than it first appears. But then of course the number of installs mean you can very likely find vulnerable installs in the wild even today.

TL;DR simple statistics don't really seem to work well in providing a proper view of comparative levels of security of web apps.

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5203

[1] https://core.trac.wordpress.org/changeset/29389

[2] https://wordpress.org/news/2014/08/wordpress-3-9-2/