Unfortunately WordPress is a pain in the butt to maintain, every plugin and even the core is a security liability if you don't auto update everything (which is likely to randomly wreck your blog someday) and Wordpress's default configuration (with its XMLRPC API) is far from perfect.