Indeed, they don't have a method for reporting security exploits. Wordpress Blogging Platform has one, but this issue is only limited to wordpress.com. I believe it has something to do with intensedebate.com

First I sent a email to matt(http://ma.tt/contact/). Then, I used the Automattic contact form(http://automattic.com/contact/)