Hackers can read arbitrary files, including those containing passwords, with this newly discovered WordPress flaw.