This is the programming equivalent of a politician embezzling money by writing a law that says "I get ten percent of all the money!" and asking everyone to pass it.

They made a pull request - which basically means a request to change the source code - to insert a huge hacker console into wp.

Thanks. I'm with parent and very curious about what this is about. Does this console give root access to the server via a web interface?

Sort of. It gives access with whatever user the webserver is running under. Might be root, but will usually be a less privileged user eg www-data.