The wording of the post is a bit misleading with this statement: "Wordfence is reporting that Ninja Forms versions 2.9.36 to 2.9.42 contain multiple security vulnerabilities." It makes it sound like Wordfence discovered the vulnerability instead of James Golovich. Of course if you continue reading you can clearly see that James Golovich deserves all the credit. ;)