This question is two-fold really. First, what are the vulnerabilities of a wordpress site within your intranet, and the second are what are the risks of certain employees to that intranet. So i'll tackle this in two parts for clarity.
Intranet and Wordpress
A lot of companies set up internal sites for various reasons, but proper configuration should be done anyway, since WP itself has a lot of vulnerabilities. One of the more prominent security issues is the ease that its login credentials can be brute-forced.
Just because the site is on a company network, doesn't necessarily mean that it can't be reached / used by people on the network. If any machine that has access to the intranet becomes compromised, it can be used to access this WP site. A technique known as pivoting, allows an attacker to compromise one machine and then use that to leverage other machines on the same network quickly. So the WP site should still conform to security standards, eg. proper authentication, strong credentials, etc. Depending on what data is going to be stored behind this page, extra measures should be taken, will it be a blog? will it be a portal for employees to see their payslips? etc.
Within any company there will be various forms of risk. Whether this be internal, like disgruntled employees, or external actors, like competitors, criminals, etc. The goal is not to reduce them as much as possible.
Internal employees have a certain level of inherent trust, as in they may have key-cards to open doors, access to certain sensitive information, websites, etc. And this can and often does lead to acts of fraud or collusion occurring, where the employee might feel as though they deserve more, they should've got that raise, they work hard, etc. etc.
Internal actors still need to authenticate with the system to gain access to its internal assets, however it can be just as much a risk if someone wants to cause damage if they get admin credentials for that site, allowing it to be used as a platform for various other attacks.
External actors will have to get into the network first, which can be done in various ways, but a poorly configured WP site would be an excellent target to compromise, and possible use to pivot, maybe the admin credentials for the site are the same for someones laptop?
In any case, an internal site should be configured to at least a certain standard to avoid cases where it can be exploited. I hope this answers your question - if not I'll be happy to add more to it if you have further questions.
EDIT: I came across this article that highlights the points made in the "Intranet and Wordpress" section of the answer. Specifically about identifying sites on local networks and bruteforcing logins. it can be found here.