Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Actually, WordPress doesn't have the equivalent of a root account; instead, some users simply have admin privileges while they ordinarily use the site. This hole wouldn't have been possible if you couldn't simultaneously have the ability to read posts and the authorization to do administrative tasks. (Or, rather, it would have been limited to author/editor-type impact.)