Therefore, your whole security scanning approach is flawed: the findings described as security problems are within the normal operation of WordPress. It would be catastrophic if such functions were publicly available, but they are restricted with a password-based login. That's the area of security you should focus on: whether it's adequate for you or not:
- Do you use strong passwords? Are there password requirements for all users?
- Would you need multi-factor authentication?
- Should the administrative areas be restricted to certain IP addresses?
- Could the content be served as static pages e.g. from a proxy or CDN? That would ultimately limit the access to all dynamic content including the administrative tools.
Furthermore, are you responsible for security auditing open source code made by others, or just the source code of your web application project? Because this is about the WordPress core, according to Wordpress Security:
The WordPress Security Team is made up of approximately 50 experts
including lead developers and security researchers — about half are
employees of Automattic (makers of WordPress.com, the earliest and
largest WordPress hosting platform on the web), and a number work in
the web security field. The team consults with well-known and trusted
security researchers and hosting companies.
If you have better resources than that, you could find and fix security problems in the WordPress core. Please contribute the findings to the WordPress project and you'd help in securing 63.6% of the web sites in the world. If Micro Focus Fortify Audit Workbench was the ultimate solution for that, it would have already been used.