WordPress auto-update server had flaw allowing anyone to add anything to websites worldwide

http://www.theregister.co.uk/2016/11/23/wordpress_auto_update_flaw/
Major security hole in WordPress auto-update found and fixed, but what was the damage?