New binary for changing user passwords

I am using Roundcube webmail and in order to allow users to change their password from within the webmail, I use the included password plugin which has a virtualmin driver. However, all this is is passing on the commands to the main virtualmin binary running as root. This could have security implications since if someone manages to alter the PHP code he can execute virtually any virtualmin command. So wouldn't it be nice if there was a binary just for changing user passwords, which also doesn't need to be run as root. Something like this: /usr/sbin/virtualmin-passwd --user myusername --password currentpassword --newpassword mynewpassword