> ignored this issue I'm not sure the author would necessarily know that this is true. The author also didn't say whether they informed WP Core that they were

> ignored this issue I'm not sure the author would necessarily know that this is true. The author also didn't say whether they informed WP Core that they were going to publish it. Per the "revision history" the notes about a report sent in 2016 was added after initial publication ("Updated 'solution' section to clarify and highlight numerous resolution attempts"). So it isn't clear to me that communicating the exploit to the team was the top priority. Regardless of the circumstances though, publishing it seems quite clearly tied to the promotion of their business. That's not necessarily bad assuming they were responsible in how they communicated the issue. I am admittedly reading tea leaves and just questioning whether this is the full story.