WordPress is not insecure. Sites running it get compromised for four reasons, in this order of frequency, and none of them is a flaw in WordPress itself.

1. A plugin that was not updated

By far the largest cause. A vulnerability is published, a scanner finds every site still running the old version within days, and the rest is automatic.

  • Turn on automatic updates for plugins you trust.
  • DELETE what you do not use. An inactive plugin is still a file that can be reached directly.
  • Check whether a plugin has been abandoned - "last updated 3 years ago" is a decision to stop using it.

2. A password used somewhere else

Leaked from an unrelated site and tried here. Two-factor makes the leak irrelevant, which is why it is worth more than any plugin.

3. Uploads that execute

If a file placed in wp-content/uploads can be run as PHP, an upload form is a way in. Close it at the server, not with a plugin.
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
}

4. Editing files from the dashboard

The built-in editor turns a stolen admin session into arbitrary code on your server. Almost nobody uses it deliberately.

define('DISALLOW_FILE_EDIT', true);

Three more that cost nothing

  • Move wp-config.php above the web root, or deny it explicitly. It holds the database password.
  • Turn off XML-RPC unless something needs it - it is a common brute-force target.
  • Hide the version. It is not security, but it removes you from searches for "sites running version X".
After any compromise, change the salts in wp-config.php. It invalidates every session, including the attacker's, and it is the step most cleanups miss.