An issue exists in Joomla! prior to 3.9.4. The sample data plugins lack ACL checks, allowing unauthorized access.
joomla joomla\\!