Of course, they can. Just as they can attack the system that Joomla is running on (PHP environment, CentOS, Cpanel, Webmint, etc.). As Wordpress is a much more common CMS than Joomla, (source: CMS statistics), there are more malicious codes for it, as the number of attacks is greater, the same attack interfaces may be available (unpatched) on multiple pages.
This will not make Wordpress worse or Joomla better, just the probability of hacking may be higher for Wordpress compared to Joomla.