On December 8th, 2015 the Plone Security Team released a hotfix for an issue related to unauthorized disclosure of registered user information.
PLONE VERSIONS SUPPORTED
This patch is compatible with all supported Plone versions (i.e. Plone 4, Plone 5). It may work on earlier versions of Plone, but as these are officially unsupported they have not undergone the same level of testing with the patch.
INSTALLATION GUIDELINES
FREQUENTLY ASKED QUESTIONS
Q: How can I report problems installing the patch?
A: Contact the Plone security team at security@plone.org, or visit the #plone channel on freenode IRC.
Q: How can I report other potential security vulnerabilities?
A: Please email the security team at security@plone.org rather than discussing potential security issues publicly.
Q: How do I get help patching my site?
A: The Six Feet Up developers stand ready to assist you. Simply contact support@sixfeetup.com. We will assist clients in the order that requests are received. 
