In reply to planetzuda.

I replied to your post this morning, but my comment looks like it's in moderation and there seems to be some confusion over this point that keeps getting repeated, so I figured I'd reply here as well....

The issue with WordPress Core that's been known for 2 years (#20267) is a separate (albeit related) issue to the vulnerability that Yan disclosed concerning WordPress.com. Self-hosted WordPress.org sites are not vulnerable to the issue that Yan disclosed.