Person
WordPress
Software vendor — in 1 story, 1 quote on record.
What they said verbatim
“Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org.”
WordPress security release · WordPress Click2Shell Flaw Lets Admins Unwittingly Install Malicious Themes