wordpress is so shitty - though it runs the majority of the web.

people think PHP is shitty cz of Wordpress.

at a certain point in time - people need to move to better ecosystems painful as that may be.

Historically, a lot vulnerabilities in PHP projects were because of PHP itself. Things like register_globals, remote includes/reads using functions that supposed to read local data and so on.