One of the great things about using WordPress as a CMS is the number of plugins. If I want a feature for my site, I don’t need to go write and test a bunch of PHP, I simply search for a plugin to do the job.
However, the more code one adds to their site, the more possibilities for errors in that code. Some of these errors might be harmless, like code that just doesn’t work, but others might cause security vulnerabilities. For instance, there was the TimThumb zero-day vulnerability a few years ago that affected many WordPress sites. A plugin’s code often has the same privileges as WordPress core, and so errors in the code could cause serious effects to one’s site.
What should a website administrator do about this problem? That part I am still trying to work out myself. I tend to be the type who wants to tweak things until they work exactly as I want, and so I have had to guard myself from installing too many plugins. I stick with the official WordPress repository, and I try to evaluate each plugin before I install it. I think of other ways that I could accomplish my goal without an extra plugin, and sometimes skim through the source code to see how things work.
Even if you don’t read the source code (which is also nice to help learn how PHP works), make sure to read the plugin descriptions carefully. I try to avoid plugins that use external databases, are making requests to other sites, or that seem to have a lot of functionality I don’t need and can’t disable.
On a related note, theme vulnerabilities are just as important. A theme is PHP code that runs on the site, just as a plugin or WordPress itself. Unfortunately, that means people who want to go out on their own and do their own theme development ought to spend some time making sure their theme follows good security practices. (For my theme, I am using the default WordPress theme as a template, and only modifying what I need. That way I save time and don’t have to learn everything about PHP security).
Running a website is a time-consuming process (as I have certainly learned), and having your server available to millions of people is both awesome and sometimes scary. So remember to be cautious and evaluate your needs before installing cool little gismos that could cause a lot of pain later.