Well, I just got some of it. Just log in to some of my managed services that using WordPress (on my personal project) and found out that there is some account that have admin level access that should not exist.
Let this be a reminder to limit using plugin as little as possible…