In reply to David Anderson.

Almost no investigation is needed to discover that, yes, there have been vulnerabilities in the plugin in the past that would allow malicious database access. If you had simply clicked on the SQL injection listed there, Patchstack says “This could allow a malicious actor to directly interact with your database, including but not limited to stealing information.”

You say your comment is because accuracy and precision matter in security reporting, not because you’re defending the bug. But you didn’t point out anything that was inaccurate, and instead provided your judgement of Snicco, which you say he invited based on his marketing of a product that isn’t mentioned anywhere in the article or in the comments.

Like you, I also prefer accurate reporting, but as far as I can tell, the article was accurate, Dan’s comment was accurate, and Snicco’s reply was accurate. I can’t figure out what you’re objecting to, other than some of Snicco’s marketing that you’ve apparently seen elsewhere.