The following vulnerable code was, according to Kyle Johnson of the WP Ninjas team ‘not a live feature of Ninja Forms, but was more of a proof of concept for a future free feature.

I call complete BS on this. Nothing about that sentence makes any sense in the real world. They screwed up bad - plain and simple.