In reply to Damian.

The responsible thing here would be for the security vendor who develops the plugin, StellarWP, to properly review the security of the code in their plugins. They are not doing that, which leads to unnecessary problems.

It also isn’t a good practice for the WordPress.org moderators to act inappropriately, which caused a full disclosure here. But, again, if StellarWP was handling things properly, there wouldn’t be anything to disclose.