@ian dunn, thank you very much for pointing out that this hole has been known for two years in the self-hosted version. We mentioned you in our article http://planetzuda.com/2014/05/29/wordpress-security-hole-publicly-known-for-years/