AFAIR the attack allows taking any old encrypted email and modifying it in a fashion so that a vulnerable client at the recipient would decrypt the message and

AFAIR the attack allows taking any old encrypted email and modifying it in a fashion so that a vulnerable client at the recipient would decrypt the message and send its content to the attacker. So the attacker needs access to the mail, either from the victims computer, mail-server or any or the senders computer, mail server (sent mail imap box) or intercepted in flight and the ability to send that to the recipient. It's not like this is necessarily hard, this is what GPG is supposed to protect against. disabling the plugin until this is fixed would prevent an attack. Depending on your risk profile, this would be a reasonable mitigation: Don't receive encrypted messages for a while, but keep old conversations safe.