I recommend you use FCVAR_PROTECTED on that sm_morercon_password convar.
Also something I find a bit strange about your plugin is that rather than giving unlimited number (or a big number of) of server you can execute RCON commands on, you simply allow to do RCON on one more... It's a bit of a "cheap" way to solve that (don't want to be mean saying that :$).
I.e. I would have more expected something like either :
- "read a file" and for each entry you can add a sm_morercon_theservername_host, sm_morercon_theservername_port, sm_morercon_theservername_pw (and maybe put that last one facultative so it can be entered in RAM memory rather than in a file)
- allow to "register" a server dynamically; and this would create the convars sm_morercon1_* (or with server name), etc...
I feel like if you were realizing that you would keep missing a variable, but rather than using an array/collection, you would use one more variable. (like currently someone with 3 servers would need to either duplicate your plugin or "chain" rcon-command). I do understand that people with over than 2 servers are rare; but I feel they would maybe like that (That could be an "extended" version of your plugin); even thought I'm not in that category.
Anyway, just throwing some ideas :/