In reply to A_Bad_Taste.

@Chuck
What seems to be missing from your thought process is that there wouldn’t have even been a vulnerability that we could full disclose if you had properly secured your plugin. The vulnerability was in your plugin for almost two years, so hackers had plenty of time that they could have exploited it before we happened to run across it.

Curiously you claim there was security audit that found the vulnerability, but what we did there wasn’t a security audit. Getting an actual security audit would be a good idea.