The plugin can be used to abuse trusted domains to load malware or other files through it (Reflected File Download) to bypass firewall rules in companies.
wp-content/aawp/public/image.php?url=[base64-url] will load and download the file from the base64-decoded URL