Very misleading coverage in this article, it imputes that there was a single contact from the security researcher to WordPress, when in fact: Golunski said he reported the issue to WordPress’s security team multiple times, initially more than 10 months ago in July 2016. The researcher told Threatpost that WordPress never outright rejected his claim – he says WordPress told him it was working on the issue – but acknowledged that too much time has passed without a clear resolution, something which prompted him to release details on the bug on Wednesday. Another black eye for the so-called “security” team at WordPress Core. Supposedly it is not a security issue according to this account, since it will be fixed as a non-security bug report. What a load of horse manure from WordPress.