For anyone interested in knowing how the UTF8 attack works, Mathias Bynens has a fantastic presentation which describes the technical details: https://www.youtube.com/watch?v=qFfjJ8pOrWY

Here's the slide deck: https://speakerdeck.com/mathiasbynens/hacking-with-unicode

Interesting anecdote from the talk: This isn't just unique to Wordpress. Spotify was vulnerable to this at one point.