According to their information on the versions affected, the vulnerability was in the code for over two years. The vulnerability should have been caught by a security review, as it involves a common starting point for vulnerable code exploited by hackers.

It’s quite troubling that the developer of one of the most popular WordPress security plugins, iThemes Security, isn’t having the security of their other plugins professionally reviewed.