We are seeing many of those attacks (via brute force) on WP-bases sites:

http://blog.sucuri.net/2012/03/brute-force-attacks-against-w...

So not a vulnerability in WordPress, just bad password usage...