Default login page reachable
Effort to fix: Moderate (a few hours)
Why it matters
Every bot knows /wp-login.php, so it gets constant credential-stuffing traffic.
How to fix it
Enforce strong passwords and 2FA, and rate-limit or challenge login attempts.
On WordPress
Add a 2FA plugin, limit login attempts, and optionally restrict /wp-login.php by IP or put it behind your CDN's bot protection.