According to a study conducted in Q2 of 2016, 3 out of 4 hacked websites are WordPress sites. The Sucuri-Hacked Website Report studied 21,821 sites and 15,769 of which were compromised WordPress sites.