Comment by flutas

Yup.

Basically:

1. Ban them from updating the plugin.

2. "btw, here's a CVE for that plugin, you have 30 days until it gets removed or ownership changed."

You can guess what's going to happen next... "Oh, they didn't fix their plugin, the repo is now owned by Automattic."