Exactly. Also remember that on many many wordpress servers you also have phpMyAdmin. You can use the username + password to login, and you'll get access even when it's restricted to localhost.
It's pretty scary to have phpMyAdmin public facing. IIRC some older versions of mysql-server even had a bug where it'd let you in with a random password in 1/256 chance!
It should be really bad, since phpmyadmin get attempts are the most frequent on my home webserver and I don't even have it installed. Maybe older vulnerable versions are still around though.