@staticsafe 7 months to fix, but php sec guys can throw out a hot fix over lunch. Why does WP even HAVE a sec team?