The plugin does not filter the "delete_entries" parameter from user requests, leading to an SQL Injection vulnerability.