You probably at least need remote access within Plex in order to install new plugins, meaning you could probably run the exploit by just having his username and password.