Looks like it's a vulnerability in the installer.

From a small bit of skimming, sounds like it's a user escalation vector, where a low privileged user can run the installer in a contrived manner to achieve privilege escalation.

https://github.com/notepad-plus-plus/notepad-plus-plus/secur...

So for my personal install, nothing to worry about here...