For those who can’t see the tweet:

“Automattic has responsibly disclosed a vulnerability in ACF but breached the @Intigriti Code of Conduct by irresponsibly announcing it publicly. I am going to work my damned hardest to ensure that the fix gets shipped to dotorg if it affects the free version of ACF.”

The tweet author is @johnbillion who, among other things, is a member of the WordPress core team and lead of the WordPress core security team.

Context for the “I am going to work my damned hardest...”: WP Engine, who own ACF (Advanced Custom Fields) are currently blocked from the official plugin repo so, I would imagine, they would not be able to push the update on their own.