I can tell you definitively, Wordpress is not an ideal platform for many reasons.
- insecure plugin architecture
- insecure file system management
- terribly low quality codebase (I've worked on it personally)
- insecure backwards compatability (ie: any password can be overwritten with a basic MD5 hash and it allows login with that password, no salt needed)
- many easy to get site scanners will identify hundreds of wordpress sites with vulnerabilities. Every plugin is a potential liability.
- no quality control on the plugin repository - there are hundreds of plugins in there today that are incredibly insecure
- plenty of core code is susceptible to injection attacks, CSRF attacks, etc
- fundamentally, I can get the source code of your website for the right price. $59 on ThemeForest (https://themeforest.net/item/marble-flat-responsive-creative-wordpress-theme/5896650) and I have all your themes files and can check them line by line for the inevitable vulnerabilities, then exploit them on your live site.
Don't take it from me, take it from the guy who founded Wordpress and hired a CEO to address the fact that "the technological foundations of the past decade weren’t strong enough for the demands of next one."
Or take it from Joost (the man who made the famous Yoast SEO plugin):
"I figured out that both the [Wordpress] Codex and the developer documentation on WordPress.org for these functions were missing the fact that you had to escape their output. In fact, the examples in them when copied would create exploitable code straight away."
Or take it from the list of 222 vulnerabilities that are public - http://www.cvedetails.com/vulnerability-list/vendor_id-2337/product_id-4096/
Or the catalogue of 4885 vulnerabilities here: https://wpvulndb.com/ - only 6 new ones last month 
or from ars technica pointing out millions of sites were at risk due to vulnerabilities 2 months ago - http://arstechnica.com/security/2015/05/actively-exploited-wordpress-bug-puts-millions-of-sites-at-risk/
https://www.quora.com/Is-Wordpress-really-written-that-bad
I've been working with Wordpress longer than most people knew what it was.
It's a disaster. Can it be fixed? Sure.
Lots of vendors use it properly by locking everything down, changing the folder structure, removing the version indicators, hardening the password function and use custom table names.
