A moderate approach
Immediate full disclosure can cause problems, as in this case. But companies often need a bit of prodding before they take action. Neither extreme of disclosure is always appropriate. I think the best approach is to initially only notify the software developer, and give them a reasonable amount of time to respond.
If they don't, publicize that the vulnerability exists, but not all the details of how to exploit it. If this still doesn't trigger any action, disclose the full details.
Hopefully, the developer will address the issue promptly. Once a fix has been released, then disclose everything. This will pose a negligible risk to anyone who keeps their systems up-to-date, and still satisfy the principle of openness.