> You can change it, but only going forward.
I don't believe this is correct in this case; realistically, I don't think they can change it at all. As far as I can tell, the WordPress contribution process doesn't involve a CLA or CAA.
That means any license change for WordPress would require getting agreement from every single third-party contributor whose code is still present in the codebase; and/or, removing or rewriting code where the contributor (copyright holder) does not agree. In practical terms, that isn't going to be possible.
WordPress itself is also a fork, which further impacts the situation if any ancient b2/cafelog code is still present in the codebase.
The key point here is that without a CAA, third-party contributors still own the copyright to their code contributions; and without a CLA, the project owner has no legal authority to re-license that third-party code in ways which violate the contributors' license.
The "change it going forwards" thing generally only applies if a CLA or CAA was used; or if the previous license was a permissive one and the new license terms don't violate the old license terms in any way.