Here's an idea. Why not implement a traffic-light system for wordpress updates? Red is critical, amber is urgent, green is "whenever". That way, you can say "hey, this is really important" without initially disclosing the details of the exploit.