Out of the box Wordpress is configured to allow itself to overwrite its own application files--either via the GUI update process, or via the GUI theme editor. This means almost any exploit can result in arbitrary PHP code execution--which can have many nasty results all over your server.
A CMS application should not be able to write arbitrary PHP code to the server under any circumstance. It's possible to configure Wordpress this way, but that is the exception not the rule.
Comments
Out of the box Wordpress is configured to allow itself to overwrite its own application files--either via the GUI update process, or via the GUI theme editor. This means almost any exploit can result in arbitrary PHP code execution--which can have many nasty results all over your server.
A CMS application should not be able to write arbitrary PHP code to the server under any circumstance. It's possible to configure Wordpress this way, but that is the exception not the rule.