You're asking: How could a hacker - with an exploit that potentially allows him/her to break into half the computers on the internet - know some secret information that is stored on a computer on the internet?

It could also just have been a run-of-the-mill exploit in WordPress.

A leak is a much simpler explanation than an independent discovery who then also managed to discover before publication that someone else has also discovered it.