The maintainer's comments are singularly unhelpful - "there's nothing you can do, just curl up and die" is pretty useless when you're faced with "take the entire company site offline" vs "maybe get exploited."
"X may mitigate some of the active attacks" is helpful - you can evaluate if X impacts you, and make a choice.
"Y is how we're seeing the attacks" is helpful - you can setup logging to see if you're being exploited.
"Z reduces but we can't say it eliminates the risk" is similar.
"SHUT IT ALL DOWN" doesn't do much but make good noise and increase the chance that the next one is considered to be a "boy-crying-wolf" scenario.
(Of course, taking all dev/test/unimportant sites down for a few hours is painless, but Wordpress/PHP runs some of the biggest sites in the world.)
Since you wrote your comment the official blog posts describing what exactly is the in the exploit have been released, and "shut it all down" was definitely the right advice to give.
After all this is done, CERT-EU isn't going to write the defense of your actions for you.