It looks like this vulnerability was reported 2 months ago (August 8). It’s concerning that the developer has not responded to this issue since they have likely been aware of it for some time now and it is a 9.8/10 risk. Thankfully, it is mitigated by Patchstack.