WordPress is carrying several vulnerabilities at once. Attackers can use them to run cross-site scripting attacks, escalate their privileges, get at information they have no business seeing, and bypass security controls. The underlying issues include server side request forgery (SSRF), CSS injection, and both reflected and stored XSS.
The combination is nastier than the individual pieces sound. Stored XSS means malicious code can be parked in the site permanently and fires again on every page load, potentially in the browser of a logged-in administrator. Pair that with a privilege escalation bug and a comment field turns into an admin account. SSRF, meanwhile, makes the web server issue requests to targets that would never be reachable from outside. In shared hosting environments, and anywhere internal services sit behind the application, that is exactly the part attackers care about.
What to do now
Get WordPress current, core as well as plugins and themes. Most successful attacks on WordPress installations do not rely on exotic zero-days. They rely on installations that have not seen an update in months.
Then switch on automatic updates, at minimum for security releases. Take a look at your user list while you are there: every administrator account nobody needs any more is one target fewer. If you are unsure whether an installation has already been touched, look for freshly created admin accounts, unfamiliar files in the upload directory, and modified theme files.