In reply to Ramon Fincken.

The story should make it more clear the claim here is that the vulnerability would only be exploitable by an attacker with access to a WordPress account with the Contributor role or above, making this is of limited concern.

It seems like it is outside of a web host's role to be blocking access to certain types of files in certain directories. Managed WordPress hosting could be an exception for that. If the restriction is on calling .php files, depending on the server setup, an attacker could get around that as well.