In reply to Bjørn Johansen.

No, Sucuri didn't disclose anything hackers didn't know by then. It was obvious from the short time between 4.7.1 and 4.7.2 that there was some major security problem that had to be fixed, and the official reasons just didn't add up to something that requires a rushed release, so people that I know actually went to look at the actual code changes and saw that there was a change in the rest API. And this was just someone that was curious, true hacker probably saw the fault few hours after 4.7.2 was released and didn't need any prof of concept from Sucuri.