Hi,
As Jeff Chandler already stated in his last comment, the current behaviour of this feature, particularly as it applies to "fwp" option name isn't a security hole. However the feature does need some improvements in the way it handles false positives.

We will make those improvements and re-introduce that feature soon.

Currently we are in the process of releasing an updated version of the AIOWPS plugin today. In that release we are going to temporarily deactivate that feature until we introduce our improvements.

Thanks,
Peter
AIOWPS plugin author