Calling this a severe vulnerability is quite an overstatement, which unfortunately isn’t uncommon coming from Wordfence. We publicly warned about this vulnerability in March 2018. If it was a severe issue, it would have been widely exploited by now and Wordfence would have already known about it, but that wasn’t the case.