My logs are showing multiple sources for the GET requests, and as far as i can tell, no penetration. Somebody is flexing their bots, either believing in error they have found a MySQL/WordPress flaw, or looking for unpatched WordPress codebase, on which this works.
Mildly irritating in that it eats a bit of bandwidth and fuzzes my stats, but other than that, script-kiddie lame.