parameter based downloading

Charlie,

As a security consultant, let me humbly suggest you report potential security issues privately to the developer rather than on a public forum…

That said, it’s intentional that the plugin is able to load documents from other sites. However there are security measures in the file, such as requiring a user agent string specific to WordPress (not that this cannot be spoofed), and only allowing the linking of supported file types, none of which are executable.

I’d like to see (privately) what you’re seeing with respect to this being abused, so I can see if there is a way to increase the security without undermining the usefulness of the plugin.