via make.wordpress.org => original post link
tl;dr: Never test vulnerabilities on someone else’s live site without their permission.
By now, a lot of you have read the post about the so-called “WordPress Plugin Confusion” whereby a plugin hosted on WordPress.org can ‘override’ a plugin not hosted here, by using the same name/permalink. Someone even made a CVE for it.
Please stop ‘testing’ this vulnerability with us.