Hello Everyone, We have two comments in reply to this post. One will fully explain what and why we did what we did and that it was responsible, regardless of the post implying we were not. However this comment will focus on the person/site who reported this issue. We were contacted by them telling us they found 2 security issues, had a post ready to go live and showed us the post content. They asked for bounty money and wanted to know when we could fix them. We replied back thanking them for bringing the issues to our attention, we always are grateful for such a thing. We also told them our dev team was already checking into both reported issues … in less than 24 hours patches were made. However, this is the part that makes all the difference. The content of their post was extremely alarming. They were publishing the exact details on how to take advantage of the exploits. They ignored our request to remove those portions and said the details would be published regardless. We continued to try and discuss with them and explain that publishing details such as that is extremely wrong, unless it was published a year or more in the future. They did not comply and wanted bounty money, or credit to make a name for themselves and build a business. They then even asked us if we wanted the details removed, we said yes of course. We also told them it was already fixed and was being tested and would be released soon. However, they never told us when the post would go live, nor told us the details were being removed. In addition to all this, the creator of that site had a script running that automatically creates their email as an admin user for the sites it’s run on. You can view this in their comments. While the script appears to be changed, even having such a thing should give anyone caution. We had no clue who we were dealing with, but clearly this was wrong. Knowing all this; they were going to publish the details on how to use the vulnerabilities, had a script that took advantage of it, and the fact that we do not have all our customer emails (only Envato does, they do not give them to us), why would we ever publish a public post about this before Envato was able to notify all of our customers? All that would do is open the door for people finding this post and taking advantage of it. The bottom line for this comment is that we’d like to ask why WPTavern / Sarah would post the link to the post that fully explains how to take advantage of the exploit? We at ThemeFusion explicitly decline the unethical practice of publishing instructions that show hackers how to use a vulnerability and which violate the WordPress standard of security issue reports: https://make.wordpress.org/core/handbook/testing/reporting-security-vulnerabilities/. We are also sad to see, that some bloggers don’t refrain from publishing badly researched articles just for the sake of publicity. We strongly disagree with posting it and highly recommend to remove it. This is for a WP theme, and an exploit through a WP hook. Details on how to exploit it, especially so soon, should not be published. We were told you would change it out with one of our own, so we ask you to change it out with the one we already emailed you here: https://theme-fusion.com/knowledgebase/security-fixes-added-5-1-5/ Lastly, we do find it interesting that nobody from WPTavern contacted us to ask us about this issue in any way shape or form. Instead of doing thorough research and contacting us, assumptions were made and even worse, links put up to take advantage of the vulnerability. We find that shocking at best. We hope this changes in the future, that is not community in the slightest form. ThemeFusion