The claim that Wordfence responsibly disclosed these isn’t really true, as they indirectly disclosed in the post that they were selling access to information on one of the vulnerabilities a day before they notified the developer (in the form of a firewall rule). So any hacker willing to pay for their Wordfence Premium service got the information before the developer, which isn’t responsible disclosure and seems problematic from a security provider. Hopefully, you will do a follow up post covering that aspect of this.

The other vulnerability isn’t really a vulnerability, since the attacker would already need to have access to a WordPress account with the Administrator role, which already normally has the capability to do the equivalent of the vulnerability.