The plugin runs, but anyone knowing the code can enter it with or without privilege.