In reply to Chris Christoff.

@chris what if it only affected 1 plugin... But that plugin was Jetpack that is used by hundreds of thousands (if not millions) of web sites. Doesn't matter if it was small number of effected plugins, the fact is that it was a "small number of popular plugins" like WooCommerce that broke tens of thousands of web sites.

And yes, BROKE is the correct term. If a web site no longer functions as intended, then it's broken.

Now, what was truly obscure was the security vulnerability itself. It was very obscure and could ONLY be exploited by someone who ALREADY had access to the site. If you did not have access to a site, this vulnerability could not be used to GAIN access to a site. The chance of a web site getting hacked is next to nil. So yes, I question the need to break WordPress in this instance.

That aside, for me, the real issue is the lack of communication. Once the update was released, the cat was out of the bag. A VERY PUBLIC posting about the consequences should have been made once the update was rolled out, not 8 hours later.