It's baffling that these kinds of organisations which are obvious targets of attacks are still using stuff like Wordpress, and then getting exploited through it. Competence doesn't grow on trees ...