In reply to KTS915.

Unfortunately, under proper software development established practices this specific bug, would have been easily detected as part of the QA, specifically any unit testing that made sure that all code paths were tested.

The problem is that the wordpress community is so used to hack solutions instead of developing software it is pointless to point at one developer for not doing what most likely no one does (free or paid, I also laugh at Ron's trust of paid plugins, in my experience they are actually worse).

What can be done? Each plugin and theme should be demanded to show its testing plan, hopefully as a phpunit tests so you will be able to test it fully on your site instead of just randomly check some features.
In addition wordpress.org can run some code complexity analyzer and give plugins marks based on their complexity. Usually the more complex a piece of code is the harder it is to actually test all its execution paths.

But in the end this comes back to money. This plugin according to its site has 1400 which are 0.5% paying users. with 30$ per user, this is not great but ok and should be enough to get someone to do proper QA. So what the paying users should do is to ask for their money back as the product was obviously defective in a relatively easy to detect way, and the cost of figuring out the implications of that security problems will be much bigger then the cost of the license. Once people will start demanding money back maybe plugin and theme authors will upgrade their game.