It appears that WPScan might be providing at least somewhat misleading information here. The change made in version 2.6.4 stops how this was reported to us as being exploited. Based on the change made in 2.6.5, it seems possible that WPScan is referring to the security being poorly implemented, which it is, as opposed to there being a bypass for the exploit that is happening.

Something else important to note is that WPScan disclosed that Automattic’s web application firewall (WAF) had failed to protect against this. We just release results of testing we did of 32 WordPress security plugins, which found that 2 of them provided protection for this vulnerability even before it started being exploited: https://www.pluginvulnerabilities.com/2023/06/30/ninjafirewall-and-plugin-vulnerabilities-firewall-are-only-wordpress-security-plugins-that-protected-against-recent-zero-day/

The 2 plugins that provided protection were able to do that because they hook deeply in to WordPress, which WAFs can’t do. That runs contrary to the common misconception that firewall plugins can’t provide protection beyond what WAFs do.