WordPress is a shitshow, RCEs, XSS, you name it. There are botnets with WP as the main vector.

Use with caution, php = bad time.