I have no inside information, but there's a lot of things you could do by simply avoiding the built-in commenting system, and exposing the admin tools only to a

I have no inside information, but there's a lot of things you could do by simply avoiding the built-in commenting system, and exposing the admin tools only to an internal network. You can pretty aggressively prune down the Wordpress install footprint/attack surface on your public-facing servers if you are willing to do some minor patching. Not to mention, a reverse-proxy layer in front of Wordpress can let you filter out the most obvious attacks and block lots of potential ones without touching the code itself.