The mandatory patch addressed a critical vulnerability in a widely used plugin that allowed untrusted visitors to download a website’s backups.
Wired