Comment by hn_submit

PHP has been a security dumpster fire for decades. It's just how the entire web ecosystem works: some web designer lacking any technical know-how is asked to make a site and dumps WordPress on it out of habit.

Even though there are much more secure CMS technologies out there like Umbraco or Piranha (both ASP.NET) and web stores like NopCommerce (ASP.NET also).

There are just too many technically clueless people building web sites and web stores.