Wowzers, that really is a security flaw! Thing is, without some way to reliably inform users (some of whom will not check their sites regularly of course) this kind of plugin-caused vulnerability will no doubt crop up again and again... Quite disturbing really!