In reply to Cavalary.

Totally agree with this!

A simple option in the admin, default OFF, would be a clean and easy solution.

Having a powerful feature on by default and disclosing such an exploit just seems so irresponsible...