Input validation vulnerability in LWS Affiliation 2.2.6

The LWS Affiliation plugin for WordPress is vulnerable to security threats in versions up to 2.2.6. Unauthenticated attackers can include and execute code from a remote server if the ‘allow_url_include’ setting is enabled. Attackers can also include code from local sources, though this is less useful because they must be able to upload malicious code to a directory that the web server can read.