In reply to David Anderson.

The wording of that paragraph is vague and it'd be nice to have more information from both sides. Only two specific exploits are mentioned -- one from November 2014, which WP patched that month with 4.0.1, and the current exploit, which was just published on Sunday and patched a day later. As I can gather, the time in between, which is the subject of the paragraph, wasn't about WP ignoring a specific exploit, it was about them ignoring more collaboration with the researcher (until the second exploit was proven).