Hello,
It wouldn’t be smart to open all ports. Firewalls are there for a reason.
As you found out, bitcoin wallets by default require *incoming* TCP connections to 8332 for the RPC API and 8333 for P2P communication. The plugin connects to the RPC API. You can always change these default numbers with the settings port and rpcport (see https://en.bitcoin.it/wiki/Running_Bitcoin ). This also means that *outgoing* TCP 8332 must be allowed from your WordPress site.
Best of luck with setting up the tunnel, let me know if you have any questions.
with regards