This could be very bad. Anyone who uses WordPress needs to make sure they’re using very strong passwords.