High severity7.2NVD Advisory· Published Sep 12, 2025· Updated Apr 15, 2026

CVE-2025-10176

Description

The The Hack Repair Guy's Plugin Archiver plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the prepare_items function in all versions up to, and including, 2.0.4. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Affected products

WordPress/Hackrepair Plugin Archiverinferred
Range: <=2.0.4
Package: https://wordpress.org/plugins/hackrepair-plugin-archiver

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

plugins.trac.wordpress.org/browser/hackrepair-plugin-archiver/tags/2.0.4/includes/list.phpnvd
www.wordfence.com/threat-intel/vulnerabilities/id/d449a285-34f5-41ed-acfd-2a9acfb04271nvd

News mentions

No linked articles in our index yet.

cvss	0.468
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000