In reply to Augus van Gils.

Hi,

Please be assured that we are not trying to minimise the bug. It took longer that we’d hoped because of problems we encountered in the back-and-forth of testing the solution.
The reason for mentioning that you need to be a logged-in admin to exploit it is because it is (rightly) standard practice to include the level of privilege needed for successful exploitation in security reports.
David