Maybe they had the same database user for the Wordpress as something more sensitive, or maybe apache/php running as a user with more access than needed alowed t

Maybe they had the same database user for the Wordpress as something more sensitive, or maybe apache/php running as a user with more access than needed alowed them to pull more creds from the code for other apps on that box. Good reason to use enviroment variables rather than hard code. Either way, keeping sensitive customer information anywhere near a public facing Wordpress install is nuts, if that's what they did.