In reply to help.

I totally disagree. The slider plugin was bundled in a theme that a PREVIOUS web developer installed for one of my clients. As such, I do not have the theme license key. There is NO WAY that I would ever have known about this extreme vulnerability had Sucuri not released it.

The bundling of premium plugins in purchased themes is maybe a practice that needs further discussion, for just this very reason. There are, however, excellent theme designers who do it the right way, like http://www.web-savvy-marketing.comwho give you a personal license to any premium plugins that are included.

On an aside, the one three-letter word that I used is mild in comparison to the damage that was caused by the author's "silent update" strategy.