I am still wondering why this 3.7 version is not already in the graveyard like the 3.8 version.
This version has the same severe security bug!!!
Send it to the graveyard at once and inform every user of this addon by email to deactivate it like you did this morning with the 3.8 version!
How long are you going to wait? Until many users complain, that their forums have been nuked?!
Come on! It's never been easier than today to get full control over a foreign vB by just modifing your browsers URL!