In reply to Jeff Chandler.

After reading through all this, it looks like this is the same vulnerability I discussed at a WordPress meetup in Oslo a couple of years ago. I was asked to provide information on WordPress security. One of the things I mentioned was the importance of securing your cookies. I explained that most big sites don't even bother, and proceeded to demonstrate to the audience that WordPress.com didn't protect themselves in this way either. I didn't consider this to be announcing a vulnerability since it was blatantly obvious.