In reply to Otto.

Your team should have been the ones planning for forcing the update before it was released, seeing as the plugin was a possible vector for a previous exploitation and it had at least two vulnerabilities that were fixed that were likely to be exploited.

There is the additional big issue with that process currently, which is that you are providing the new version of the plugins to hackers before websites can easily upgrade to it, since the new version gets added to the Subversion repository while the plugin is stilled closed. It usually is easy to work back from the changes being made to how to exploit the vulnerability being fixed if you know what you are doing.

You really need to bring in additional people that have a better understanding of security or be willing to work with others, like us, that have a better understanding of it, so that your processes can be improved, because right now your team is making mistakes that should be easy to fix. Not just with this, but, for example, with your failure to make sure your manual security reviews of new plugins before they are allowed in the Plugin Directory don't miss easy to spot exploitable vulnerabilities (we have repeatedly offered to help your team with that).