These days you can't even report a bug without being attacked by the demented fanboys and having it spiral into a three-page thread. Apparently, the devs in their infinite wisdom have kept silence about (and not bothered to fix) the problem because they don't want it exploited, it's a very minor bug which only breaks people's sites if somebody knows exactly what they need to feed into the browser, and people should never ever complain about vulnerabilities in wordpress because they don't have to pay for it. It must be nice to live in their universe.

I still fail to understand why none of the developers could have replied to the original post saying 'thanks, we were aware of the bug but it kind of got lost in the race to 1.3; it has now been fixed and we will be publishing a patched downloadable version of wp-login.php on the development blog.' That is simple. It is logical. It is helpful. Which is why it was never going to happen. I cannot wait for Shelley to release Wordform.