The vulnerability was reported to the ACF team on the 2nd May, not in February as the article states. We patched and shipped ACF 6.1.6 on the 4th May, not in April. We take security extremely seriously and the team worked hard to get the fix out in 48 hours.