Context matters a bit. From what i understand its a plugin that's only sometimes used and would typically (but clearly not always) be not exposed to the internet.

So its a serious vuln, but not as serious as say if it was in a component that was always exposed to the internet in the core part of vmware. I guess vulns can always be worse.

How bad it is depends on how you use vmware. I mean regardless, clearly everyone affected should patch.