On its own, the WordPress Content Management System offers a minimal amount of security against what appears to be an unrelenting entourage of hacker attacks.
It has to, really. If the software were programmed and packaged to fight every single attack, it would suffer from an unreasonable size and upgrade regimen. It would also suffer from performance issues across server platforms.
WordPress is the preferred open source software package that is installed on about 60 million websites mostly because it is easily deployable across many systems.
For those reasons alone, it is vulnerable to multiple security issues, making it imperative that WordPress users implement their own security measures against existing and developing risks.