In reply to richard.

WordPress is a popular CMS and brute force attempts on login forms is an easy thing to do. This has zero to do with security in WordPress Core. Every login form gets bruteforced regardless of CMS be it Drupal, Joomla, some custom thing etc.