@Viss @da_667 @joshbressers I can't get there. I've done as much WordPress as anyone, and the security model from the jump was patently wacky.
The admin dashboard has a PHP editor. That's not tacked-on; that is the default. That's leaving aside nonsense like xmlrpc.php brute forcing.
It has a great design editor and a great text editor. But the security of the application was from the starting point a liability.