Wordpress has a lot of security issues due to its age and modularity. At some point devs needed to just say no, they never did, and now it’s everyone’s problem