Both bugs let a threat actor turn a vulnerable WordPress website into a beachhead. They can get code, or accounts ...