I hope there'll be an official response from wordpress.org to the rather disturbing paragraph in the advisory of the security researcher who discovered the vulnerability, in which he says that they simply declined to receive any communications about this vulnerability after it was discovered. It would be good to hear their side of that.