I don't know what the situation in the UK is, but it is probably safe to say that, while possibly legally in the right, such a publication is risky in most jurisdictions.
Personally, what I'd do in such a situation is to contact a well-renowned hacker organization with experience in these matters (as for instance the CCC here in Germany) and ask for their assistance.
Alternatively, a tech publishing company could also be the right choice, preferably one with a legal department and experience in these things. He mentions that you should buy the issue of "Computer Active" that contains this article, so he probably took this route.
An interesting point, but if interpreted by the wrong person, using wpscan (which makes a load of requests to the site) could be considered dubious under the CMA (I definitely wouldn't run in against a site which I wasn't authorised to test)
From what I know vulnerability scanning (which is essentially what wpscan does) is a bit of a grey area under UK law.
It's been likened to someone "rattling the windows" of a house. They may be doing it with the intention of notifying the owner that he's left his house unlocked, or they may be doing it to attempt to gain unauthorised access..
The analogy isn't perfect but it's one I'd step carefully on.
I'm UKian and I'm astonished. Having worked in the UK Civil Service, sounds to me the person making this decision didn't know what it meant and that it was an actual security issue. Probably they thought it was sort of idly interesting, like speculating how many office computers are still beige. Not that you were listing sites with trusted nhs.uk domains that appear to be easy to hack.
I can assure you that we made it abundantly clear how bad the problem was - including sending link, screenshots, etc. Had phone calls with them where they did sound genuinely concerned.
We spoke to HSCIC who manage .nhs.uk. We also spoke to senior civil servants in the Department of Health. We also contacted people who were listed as the owners - but in many cases were no longer responsible for the sites.
With some, we were able to contact the developers behind the sites. Others just didn't respond.
Basically - no one in the NHS or DoH knows who manages the thousands of .nhs.uk websites. We did our best to contact individual site owners and, where that was impossible, alerted the government directly.
