The plugins are vulnerable to remote code execution (RCE), a.k.a., arbitrary code execution. The plugin authors have since provided updates. If you haven't updated - get it done now.

The original post in the WordPress Forums: [wordpress.org...]