In reply to Ryan Hellyer.

This is what the discloser is saying. Given that Klikki Oy and the WordPress' security team have worked together before to close a vulnerabiity it does seem odd that either party would wilfully not co-operate this time round.

A cursory glance at Klikki Oy suggests they reported this in November, and then made a minimal disclosure at the end of January.