Your WordPress site has zero plugins installed. Fresh deployment, bone-stock configuration. And it’s already vulnerable to full remote takeover - no login required ...