In reply to David Artiss.

A security breach should always be discussed in private until confirmed.

WPML is not a trivial plugin, deactivating it on a production site is not a good idea. Now that the breach has been has been confirmed as a internal security problem, you should delete this sentence:

” If you are using the plugin, you should deactivate it until the company pushes an update to patch the security vulnerabilities.”