Aha, the long-awaited clarification. Turns out the majority of speculations were correct after all.

Still, existence of the SQL injection vulnerability should've been disclosed two weeks ago(!), instead of dodging all speculations.