Arbitrary File Deletion in The Hack Repair Guy's Plugin Archiver for WordPress

CVE-2025-10176

What is CVE-2025-10176?

The Hack Repair Guy's Plugin Archiver for WordPress is susceptible to arbitrary file deletion stemming from inadequate validation of file paths in the prepare_items function. This flaw affects all versions through 2.0.4, impacting authenticated users with Administrator-level access or higher. By exploiting this vulnerability, attackers can delete critical files from the server, potentially leading to remote code execution if key files such as wp-config.php are removed.

References