CVE-2025-10176 Overview
CVE-2025-10176 is an arbitrary file deletion vulnerability in the Hack Repair Guy's Plugin Archiver plugin for WordPress. The flaw exists in the prepare_items function within includes/list.php and affects all versions up to and including 2.0.4. Insufficient file path validation allows authenticated attackers with Administrator-level access or above to delete arbitrary files on the server. Deleting sensitive files such as wp-config.php can trigger WordPress reinstallation flows and lead to remote code execution. The issue is classified under CWE-22 Path Traversal.
Critical Impact
Authenticated administrators can delete arbitrary server files, enabling site takeover and remote code execution when critical files like wp-config.php are removed.
Affected Products
- Hack Repair Guy's Plugin Archiver for WordPress — all versions through 2.0.4
- WordPress installations with the plugin active and accessible to administrator accounts
- Multi-administrator WordPress environments where account compromise extends to file system access
Discovery Timeline
- 2025-09-12 - CVE-2025-10176 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-10176
Vulnerability Analysis
The vulnerability resides in the prepare_items function of the plugin's list.php file. This function accepts file path input without validating that the supplied path resolves to a permitted directory. An authenticated administrator can submit a crafted path containing directory traversal sequences. The plugin then passes the unvalidated path to a file deletion routine, removing the targeted file from the underlying server filesystem. Deleting wp-config.php causes WordPress to enter the installation wizard on the next request, which an attacker can then complete with attacker-controlled database credentials to gain full remote code execution.
Root Cause
The root cause is missing canonicalization and allowlist validation of user-supplied file path parameters within the plugin's archive listing logic. The plugin trusts input that should be constrained to its own archive directory but instead operates against any path the PHP process can reach.
Attack Vector
Exploitation requires an authenticated session with Administrator privileges or higher. The attacker submits a request to the plugin's archive management interface containing a path parameter that resolves outside the intended archive directory. No user interaction is required beyond the attacker's own authenticated session. See the WordPress Plugin Code Snippet and the Wordfence Vulnerability Report for technical details.
Detection Methods for CVE-2025-10176
Indicators of Compromise
- Unexpected absence of wp-config.php, .htaccess, or index.php in the WordPress root
- WordPress site unexpectedly displaying the installation wizard at the root URL
- Plugin Archiver requests in web server logs containing ../ sequences or absolute paths in query parameters
- New administrator accounts or database connection settings appearing after a file deletion event
Detection Strategies
- Inspect web server access logs for POST or GET requests to wp-admin/admin.php referencing the hackrepair-plugin-archiver page with suspicious path parameters
- Monitor file integrity for the WordPress root directory and the wp-content tree using a file integrity monitoring tool
- Alert on PHP file deletion events under the document root performed by the web server user
Monitoring Recommendations
- Enable WordPress audit logging to capture administrator actions, including plugin interactions and configuration changes
- Forward web server, PHP error, and filesystem audit logs to a centralized log store for correlation
- Track administrator account additions, password resets, and role changes as high-priority events
How to Mitigate CVE-2025-10176
Immediate Actions Required
- Deactivate and remove the Hack Repair Guy's Plugin Archiver plugin until a patched release is verified in your environment
- Audit all WordPress administrator accounts and remove or reduce privileges for accounts that do not require Administrator role
- Enforce multi-factor authentication on all administrator accounts to limit the value of stolen credentials
- Restore wp-config.php and any other deleted files from a known-good backup if deletion is confirmed
Patch Information
No fixed version is identified in the available references. All versions up to and including 2.0.4 are vulnerable. Monitor the plugin repository and the Wordfence Vulnerability Report for an updated release and apply it once available.
Workarounds
- Remove the plugin entirely from production WordPress installations
- Restrict filesystem write and delete permissions for the web server user so it cannot modify wp-config.php or other root-level PHP files
- Place a web application firewall rule in front of WordPress to block requests to the plugin's admin pages that contain path traversal sequences
# Remove the vulnerable plugin via WP-CLI
wp plugin deactivate hackrepair-plugin-archiver
wp plugin delete hackrepair-plugin-archiver
# Harden wp-config.php against deletion by the web server user
chown root:www-data /var/www/html/wp-config.php
chmod 640 /var/www/html/wp-config.php
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
