We're super grateful to Sucuri for responsibly disclosing this vulnerability. They're a great gift to the WordPress community, and the open source ecosystem at large.