Not necessarily, web GUI password and user/root ones can be different.
From an attacker's point of view: he just needs to crack the Wi-fi (e.g. aircrack-ng), join the LAN an then bruteforce the Pi-Hole webadmin password.
I read further up [1] that Pi-Hole auth is http not https, so if you cracked the WiFi aready, sniffing the webadmin password might yield a quicker return than brute-forcing (depending on strength of password, and owner's login frequency). Assuming the maximum password length of PiHoles is not < 20 chars.