In reply to David Artiss.

you are joking, right? lets compare the number of sites that run 4.6 that were hacked to the number of sites that run 4.7.

The problem is actually that the opposite of what you say is true. There is simply no continuous improvement
In the quality of core's code. The bug causing this issue is a basic input sanitation bug, and I could dig into who submitted the code, and point the finger at him, but the truth is that the people that were supposed to code review the code and QA the code are actually more to blame than the poor guy/girl that actually wrote it. The fact that this kind of code made it to a release shows that there is no proper process to ensure that the next release will be "better" than the previous one.
And all the people involved in the rest API are wordpress veterans so "it was a newbe mistake", can not be a valid excuse (if it can ever be).

Every release adds more unuseful bloat to the previous one, instead of fixing the structural problems of it. Why do you thing that a 4.8 release, which focus only on UI, will have a better security than 4.7?