Hi,
That vulnerability was fixed a very long time ago (over 3 years), and it is also impossible to exploit it within the latest WordPress versions (4.5 and further). The exploit was actually never tested to be working, and was never reported as an issue, it was only a potential threat, reported by a security expert, not published before the fix.
I’m afraid the issue is probably unrelated to the plugin, you might have to ask a security expert about the problem.