to be fair it is one of the top CMS's on the web (probably won't be in 2027) and its PHP / Mysql which in history have been very exploitable.