Wordpress has always been a dumpster fire when it comes to security. I actually worked on a fork of Wordpress 20 years ago as part of a university project. Turns out Wordpress has had a remote code execution vulnerability for the past 10 years 😬