Just about everything should be https now.
I just examined the 5.2.3 php files (844 files with 365741 non-blank lines -- yikes!!) and found several references that might be real. I say "might" be because it is difficult to know what becomes of an http url being built deep in some php function. I'm just starting out in WordPress and php so it's a little bit over my head now.
As an example, in
wordpress/wp-activate.php are the lines:
printf( /* translators: 1: site URL, 2: username, 3: user email, 4: lost password URL */ __('Your site at %1$s is active. You may now log in to your site using your chosen username of “%2$s”. Please check your email inbox at %3$s for your password and login instructions. If you do not receive an email, please check your junk or spam folder. If you still do not receive an email within an hour, you can <a href="%4$s">reset your password</a>.'), sprintf('<a href="http://%1$s">%1$s</a>', $signup - > domain), $signup - > user_login, $signup - > user_email, wp_lostpassword_url() );
where in the
sprintf() appears that the site url is formed using http://. This code is living inside two else clauses and, for all I know, might only get here if the site is detected as running with http.
Has the WordPress codebase been audited for the presence of insecure http: URLs?