In reply to Jovan Mena.

This is a minor vulnerability, which shouldn’t have been covered by the WP Tavern when they ignore more news worthy security issues. But to say that it affected no websites doesn’t seem accurate.

Also, it’s hardly proactive for the developer to have released a fix two months after being notified.

The approach you are advocating, which doesn’t involve plugin developers actually doing security due diligence, but instead requires others to find vulnerabilities, frequently produces really bad outcomes. There was recently a situation where a hacker found a serious vulnerability in a plugin with 200,000+ installs and exploited it.

Right now, most vulnerabilities are found by security providers looking for press coverage or hackers. Considering that, among other issues, security providers, other than us, often fail to even make sure the vulnerabilities they disclosed have actually been fixed, the result of this approach is continued insecurity and hacked websites.

With that exploited vulnerability and the one discussed in this post, they could have been caught earlier if the developer had done a security review of the plugin or gotten someone else to do one. Getting more security reviews done would be the proactive approach here, but it currently isn't happening.