If you find a security vulnerability with the Friends plugin, please use the contact form at https://wpfriends.at/get-in-touch/ and we'll follow up with you on the next steps.