Reply to post:

And very likely several plugins with severe vulnerabilities.

PHP is bad. PHP in actual use tends to be much worse -– most of the PHP code I've seen is execrable. Wordpress and its toxic "ecosystem" of half-assed, unmaintained plugins is worse again.