Wow, TIL that "36%" is most. Your own quote tells you that their measurements are only sites they scan and can determine the CMS used. As I said, WordPress is extremely popular in the SEO spam community and powers thousands of dead blogs, but it's a far cry from powering "most of the web".
None of that is material to the original point that thousands upon thousands of unpatched WordPress sites might work but also deliver tons of malware. WordPress' popularity is problematic because it has had a d will keep having serious security problems. WordPress exploits are entirely automated and performed constantly by zombie networks.
None of that is material to the original point that thousands upon thousands of unpatched WordPress sites might work but also deliver tons of malware. WordPress' popularity is problematic because it has had a d will keep having serious security problems. WordPress exploits are entirely automated and performed constantly by zombie networks.