Malware in UpdraftPlus – Help Me Out Of This Loop

I have a security vulnerability query with regards to Updraft Plus – Free Version. Your support pages refer me to the WordPress Forums but the WordPress Forums state that security vulnerabilities should be discussed with the Plugin Vendor prior to making them public (to avoid others being impacted by the exploit).

I am stuck. You tell me to post to WordPress Forums, WordPress Forums tells me to contact you first.

Please help me out of this loop.