I spotted this in August 2014 and reported it via Automattic's responsible disclosure process (bug number #25376). They acknowledged it quite quickly and patched the hosted Wordpress.com accounts within a few weeks, and said they'd submitted a report for it to be fixed upstream, but then went silent and didn't respond to any more requests for updates. A year and a half later they awarded a $100 bug bounty with no other information. I still don't know if it's been patched in the open source Wordpress release.