Plugin doesn’t work if WP core is installed in a subdirectory

Our WordPress installation has core files in /wp
Therefore the user admin page is at https://example.org/wp/wp-admin/users.php

The code fails in lock-user-account/includes/class-user-meta.php at line 73, which assumes that WP is installed in a standard way.

I would suggest that this line would be better written as

...&& strpos( wp_get_referer(), '/wp-admin/users.php' ) !== false )

because this would check that the referrer contains the correct path, rather than equals the default path.