This is a WordPress specific problem... Not really that big of a deal. Sure it could be useful for a bad actor to use this method to define a username to initiate brute force attacks against..but it's a WordPress problem -- not specific to just Wired.