RIPS Tech Blog, from a code analysis security company, publishes vulnerability research on WordPress, Joomla, and Moodle.
HN links it for WordPress and CMS exploits. One commenter notes a file-delete-to-code-execution bug it disclosed took over seven months to fix and was still unpatched when published.
It took more than 7 months to fix https://blog.ripstech.com/2018/wordpress-file-delete-to-code-execution/ and at the time rips went public with it (after waiting for 7 months) it still was not fixed.
That a POST param even was used to as the path to a file to delete without sanitizing it is not usually indicative of "secure coding practices".