The issue only affects 3.x users, and is fixed in version 3.4.3.

2.x or 1.x users are not affected.

Further, the vulnerability only exists via *logged-in* users, making it a lower-grade security issue overall.