I tried it on my website and I couldn't even get it to submit the login details properly, here gbatemp uses cloudflare and probably some other protection things that would probably block you after too many repeated attempts or even one of the administrators could block you if all login attempts are logged
The administrators here probably all use long secure passwords anyway so even if you could make infinite attempts without any blocks/ratelimits or even got an administrator's password hash it would take a long long time to brute force the password