The plugin contains an Auth Bypass vulnerability. To bypass authentication, the attacker only needs to know user’s username. Depending on the username, which can be easily queried because it is usually public data, the attacker may even get an administrator role on the client's website.