Just checked out the original version of b2 Wordpress was forked from and could immediately spot a SQL injection which I can use to take over the whole site:

    $log = $HTTP_POST_VARS["log"];
    <..>
    $user_login=$log;
    <..>
    SELECT ID, user_login, user_pass FROM $tableusers WHERE user_login = '$user_login' AND MD5(user_pass) = '$password'

Later it also stores the hashed password as a cookie.

Some quality 2003 code :)

Not necessarily if magic quotes are enabled!!

Oh "magic quotes", we hardly miss you.

2003? If I remember correctly, SQL injection has been in OWASP Top 10 until 2016

The code is from 2003.

Yeah, I got that, it's just that could as well be more recent^^