Aren't WordPress pages, like those of most CMSes, generated from a database?
If so, here's the dirty little secret of open-source CMSes, PHP, and shared web hosting: on many shared hosting servers, everyone's PHP scripts run with the same privileges (i.e. with the UID and GID of the Apache daemon).
This means that, if PHP can read your scripts, it can read the scripts of every other customer on the server. And vice versa.
But, many open-source CMSes store high-privilege database credentials in their PHP scripts. Drupal does this; Joomla does this; I haven't looked at the WordPress source but I'd be surprised if it didn't do this.
In short: It's extremely likely that fully-privileged access to your WordPress database is within trivial reach of every other user who shares the server with you.
I sort of hate to write that in bold but I feel like I've been banging my head against a wall with this issue for a few months now, during which time I've run into two, possibly three apparently-reputable hosting companies that use this setup, and just can't be bothered by the enormous security problem it presents.