In reply to mark k..

As I understand it the code is exploitable whether they had the 3.0 preview running or not, so the "bad code" was installed and exploitable regardless of opting in to test it or not. That's the issue Mark is referring to.

If a site has not manually enabled the 3.0 code for testing, it is trivial for an attacker to bypass this and execute the 3.0 code. For all of the following vulnerabilities a site admin does NOT need to have enabled the 3.0 codebase.