> security issue in a WordPress plugin

Classic. Installing random crap from the wp ecosystem is something I expect of amateurs, but it's disappointing devs active in the foss community could install and store such things on the same account as their software downloads which btw aren't signed. Irresponsible. And why aren't they disclosing which plugin was it?

(and sort of a bit related, in case somebody missed it: http://wpmu.org/why-you-should-never-search-for-free-wordpre... )