In reply to David Artiss.

Actually David, if I understood this correctly there was no issue with WPML plugin at all.

Exploit was on the server and ex-employee used this exploit to change wpml.org site and access send those emails.

This means that journalist have failed and mislead people that there is something wrong with the plugin.

Poor journalism would have been to have waited for a full response before telling anyone

No, poor journalism is when you assume something and warn people without actual proof. They could have check with someone if there is in fact any exploit in the plugin (not necessary wpml.org) and then warn people.

This is like assuming there is a killer in someones neighborhood and they are warning people based on assumptions not actual proof just to find out that the person is not a killer at all.

Journalism is about the proof, not assumptions, that’s tabloids 😉