In reply to sarah.

No we did not make it public until Envato did because not every customer could be aware of it, we made that clear in our reply.

As you well know, we do not control Envato. In addition, we disagree with ever disclosing how to take advantage of a vulnerability, how can that be good for anyone?

There are customers who do not update, may not know about, or simply prefer not to. We would not put them at risk by publishing exact details on how to do it and our customers thank us for that.

We've said what we needed to say and yes it has been made public. By Envato and through our public support channels and a blog post is coming but it contains more information that just the security fixes. It explains the why and what, unlike this post that assumes.

Clearly we'll agree to disagree.