The method LucenePluginApi#getLucenePlugin does not check for programming rights, and always returns the internal LucenePlugin instance, which is not needed/recommended.