wait so this Wordpress admin password cracking botnet is possible because WP doesn't limit failed login attempts *at all*? <facepalm>