In reply to Augus van Gils.

It doesn’t seems like they are trying to underplay the seriousness of the issue. But it does seems that others are interested in overstating the impact or haven’t fully checked over things before making overstated claims (like not realizing the logs were automatically wiped), which is a common problem.

Based on our experience, noting the privileges needed would indicate someone that knows about real security. It is quite common for people claiming to have discovered vulnerabilities in WordPress plugins to not even know that they were only able to do something because they were logged an Administrator, which has explicit permission do what the vulnerability is supposed to allow.