Actually, I was wrong about the last one. vsprintf does what it is supposed to. The issue is that $wpdb->prepare can take an array of strings as one argument (a

Actually, I was wrong about the last one. vsprintf does what it is supposed to. The issue is that $wpdb->prepare can take an array of strings as one argument (as in $wpdb->prepare("%s - %s", array("a","b"))), or as multiple arguments ($wpdb->prepare("%s - %s", "a", "b")). The code that calls $wpdb->prepare in this exploit intends to do the latter, but because there is only one argument which happens to be an array, it ends up that the former is used.