In reply to Otto.

Currently 13% of active installations are 1.3.x or older.

The plugin has 100k+ active installations, 78k downloads during last week, that's about since the incident.

That means at least 22k are not at latest version yet, at least 9k of those are in 4.x.

Result of quick math:

An absolute minimum of 9k sites can still be taken over completely due to this vulnerability.

Maybe over 22k sites, if the vulnerability also exists in 1.3.x version.

The actual still vulnerable number is higher, the unknown real number behind 100k+ is actually more than 100k.