You want data instead of metaphors? Perfect. Let’s do data. 1. “Every major platform has CVEs” Correct. But CVE count ≠ CVE impact. That’s like saying “Everyone has scars, so knife fights and paper cuts are the same.” WordPress Core CVEs 2022-2024: Privilege escalation, auth RCE, stored XSS in core blocks. Laravel CVEs 2022-2024: Mostly `CVE-2024-XXXXX` in first-party packages, requiring composer packages you opted into. One ships vulns in default install. The other ships vulns in code you chose to add. See the difference? Source: http://cve.mitre.org. Go count. I’ll wait. 2. “Attacked because of market share” You keep repeating this like it’s a defense. It’s an indictment. Sucuri Hacked Website Report 2023: 96.2% of CMS infections were WordPress. WordPress market share: ∼43%. So WordPress is 2.2x overrepresented in hacks vs market share. Windows has 70% desktop share and ∼70% of malware. Proportional. WordPress has 43% share and 96% of infections. Disproportionate. That’s not “scale”. That’s “design”. Data enough for you? [http://sucuri.net] 3. “Ecosystem problem, not core” You keep saying this like WordPress core and ecosystem are divorced. They share a bed, bank account, and children. Core enables the ecosystem. Core gives every plugin `add_action('init')` with zero sandboxing. Core lets themes run `eval()` on boot. Core has no dependency signing, no permissions model, no default CSP. If 96% of your crashes are caused by the tires you manufactured, you don’t get to say “but the engine is fine”. You built the whole car, sir. 4. “Architecture isn’t a vulnerability” CVE-2022-3590: WordPress object injection via `maybe_unserialize`. Root cause? Core’s architecture treats metadata as executable PHP objects. CVE-2024-31209: Stored XSS via Navigation block. Root cause? Core’s block architecture + lack of output escaping by default. Those aren’t “preferences”. Those are CVEs. Caused by architecture. You can Google the IDs. 5. “40x and 500% are invented” They’re called illustrative multiples, not forensic audits. But since you want numbers: Patchstack 2024: 97% of WP vulns are in plugins/themes. WordPress plugin repo: 60,000+ plugins. No mandatory code review. Laravel Packagist: Most packages have CI, tests, and maintainers get emailed for vulns before public disclosure. So yes, your attack surface is objectively orders of magnitude larger. If you need me to do `60,000 / 100` to prove 40x, I will, but I assumed you passed primary school. You asked for the difference between “frequent target” and “insecure core”. Here it is: Frequent target + monolithic legacy architecture + un-sandboxed plugin system + default-open XMLRPC + global state = insecure core. You can separate “core” from “ecosystem” in a debate. You cannot separate them on a server.
Post summary
This post critiques WordPress architecture and cites specific CVE IDs, but it neither provides PoCs, exploit code, active exploitation claims, patches, nor debunking, making it a general commentary on vulnerability impact and design.
