Add notes for CVE-2019-8943/wordpress

The path traversal issue itself is still open although cannot anymore be
taken advantage as the remote code execution angle is already covered by
the libgd2 update issues.