In reply to J.

Yes, but I was surprised by the absence of a post covering the issue on https://www.elegantthemes.com/blog/.

After receiving the email, I'm sure I wasn't the only one looking for updates and discussion on the situation over there.

Given the critical nature of the vulnerability and the number of people affected, surely that would go hand in hand with email notification which is hit and miss at the best of times?

Perhaps not the kind of post people love to write, but ultimately positive for a brand.

For instance, I think this kind of disclosure builds trust: http://blog.linuxmint.com/?p=2994

Or perhaps I'm being a bit harsh?