Comment by jonny_eh

Looks like changing root’s password blocks the exploit but if you disable the root user, it re-enables the exploit.

Protect yourself by changing root’s password: ⌘ (Command) + Space, Directory Utility, click the lock and enter your password, Edit -> Change Root Password…, then do NOT disable Root User.

Or open a terminal and do:

    sudo passwd