Never mind @germankiwi, I think the response to the original source of the discovery was posted in the same spirit of indignation as your reply to it.
In any case, we are grateful to the people who have alerted the community to the vulnerability.
There is a patch that has been posted, and it doesn’t require advanced knowledge to implement it beyond opening the file mentioned and making the change, although a patch to a broken thing is just a sticking plaster that will eventually fall off if the plugin author has decided to abandon the plugin.
Since the author does not appear to be responding to any of the questions, or even trying to address the concerns of the people who are worried, now is probably a good time to investigate the alternatives.
Nobody knows why there has been no response. I can see how upset people are, and I can empathise too because I am one of the people who have (had) the plugin installed on quite a large number of sites.
On the other hand, I’m thinking that considering the fact the plugin hasn’t been updated in so long, it was a good reason to have stopped using it.
Now I can understand the intense pressure on the author, who provided a free plugin in the WP Repo, and who clearly moved on a while ago, is suddenly in the spotlight and under fire from all angles by people all over the world, and his name is up in lights on some of the major WordPress Security blogs.
Yes, he should respond, but wow, I am also really feeling for the dude right now.
The vulnerability that is being spoken about is a “proof of concept”.
Has anyone actually been exploited by this? I haven’t seen a single post where someone has verifiable proof that they have been compromised (yet).
Now that the weakness is exposed in public, it is almost an invitation for script kiddies to try their best.
It also probably means that the best course of action is to remove the plugin immediately and find an alternative, and as a community, let’s stick together and keeping helping each other out.
If I am feeling indignant, it is because that if the author was apparently able to be reached, as claimed by one of the respondents in the post written by the people who demonstrated the “proof of concept”, then why did the authors of the post not manage to do the same, and then follow the correct procedures by working with WordPress Core and the Author to release a patch before announcing it in public and disseminating widespread alarm.
