It's an artifact of their development practices and code quality that requires such frequent updates, not a desire to provide regular small patch sets.

See tptacek's comment on their implementation quality: http://news.ycombinator.com/item?id=806910

You can also compare the quantity and severity of vulnerabilities against MediaWiki:

http://www.securityfocus.com/cgi-bin/index.cgi?o=0&l=30&...

Why do there have to be frequent security updates in first place?

If they didn't manage to tighten up their very limited attack surface in 6 years then I'd say it's a lost cause.

For me the problem is not that they release frequent updates - I would have a problem if they didn't release frequent updates to known severe vulnerabilities. If you look at their release logs you will see that most of their security updates has 24-48 hours of turnaround from the time of the vulnerability detection.

The recent vulnerability that this blog and most others (ie, smashing magazine) got affected has been fixed 2 releases before the current release. People who are affected didn't update for the last 3 release and someone developed a script out there that automatically scans for that vuln. and takes advantage of it.

From a security standpoint Wordpress is a trivial application because it's almost entirely read-only, except for the comments. Making a plugin-architecture bullet proof is a different story, but as I understand it most of these issues affect the very core, i.e. a vanilla wordpress install.

There is no excuse for their sorry state of affairs.

That list lumps in security vulnerabilities from over 4000 third-party plug-ins.

For me, I am subscribed to their blog so get notified by e-mail when there is an upgrade, from there it takes less than a minutes to login to my admin and upgrade. As a matter of fact, I did my last update from my iphone when I was on the road.