It took more than 7 months to fix https://blog.ripstech.com/2018/wordpress-file-delete-to-code... and at the time rips went public with it (after waiting for 7 months) it still was not fixed.

That a POST param even was used to as the path to a file to delete without sanitizing it is not usually indicative of "secure coding practices".