Yes, I meant that it is hard to match binary to source. Publishing a binary with spyware and claiming that it corresponds to source code which has no spyware can go undetected.
In the above example of WordPress, I assume OP checked the production PHP code. Since WordPress is shipped only as source (as far as I know), this would rule out the presence of spyware in the site.
If the site was running a compiled CGI plugin, finding that the source code has no spyware, does not mean that the binary has no spyware. The spyware might even be in the apache binary.