In reply to Jasper van der Meer.

Jasper, if this vulnerability is really present in WPML itself don't you think other WPML websites would get hacked?

Don't you think security researches would have already discovered it, or will soon?

Don't you think the actual vulnerability would be disclosed?

Don't you think the "hacker" would provide some actual proof of the vulnerability?

This entire story smelled fishy from the start. This just isn't how vulnerabilities are disclosed by security researches, or exploited by malicious hackers.

A malicious hacker would hack sites.

A real security researcher would responsibly disclose, so the vuln would get fixed before being made public.

Stuff like this is unheard of unless the company ignores the vuln when it is responsibly disclosed to them.