Electrum versions from 0 up to 4.7.2 have an authorization bypass vulnerability in the external plugin loader. This flaw allows execution of a plugin's __init__.py module if the plugin is marked enabled in the config file, without verifying the plugin's password signature. A local attacker with write access to the Electrum data directory can exploit this to execute arbitrary code within the Electrum process. The issue is fixed in version 4.7.2.