On the other hand: it is Wordpress, who knows how many other exploits could be hiding among the dozens of plugins it likely has installed?