well, the problem is that a lot of people do load vulnerable plugins and that makes wordpress an attractive target.