Multiple requests to wp-login.php flagged by WAF and security rule alerts indicate potential brute-force or credential stuffing attempt.