Your headline and story seem misleading, as what is described there isn’t a vulnerability, but a security issue, since there is nothing the attacker can do without some other issue. Snicco unfortunately has a history of misleadingly describing security issues as vulnerabilities to criticize competing security solutions. It’s not something that others should be helping them to do, especially when Snicco’s own security solution doesn’t provide the protection they claim it will.

If a plugin, theme, or WordPress core, or a database is compromised at the hosting level or is subject to another vulnerability that allows the attacker to update WordPress options, then they would usually already have the ability to takeover the website. The proof of concept provided creates a new Administrator account, which is what you could normally do with those actual vulnerabilities without needing another security issue to exist.