CVE-2025-10188 Overview
CVE-2025-10188 affects the Hack Repair Guy's Plugin Archiver plugin for WordPress in all versions up to and including 2.0.4. The plugin fails to validate nonces on the bulk_remove() function, exposing site administrators to Cross-Site Request Forgery (CSRF) attacks. An unauthenticated attacker can craft a malicious link or page that triggers arbitrary directory deletion within /wp-content when an authenticated administrator interacts with it. Successful exploitation removes plugin archive directories from the WordPress installation. The weakness is tracked as CWE-352.
Critical Impact
Attackers can delete arbitrary directories under /wp-content by tricking a logged-in administrator into clicking a crafted link.
Affected Products
- Hack Repair Guy's Plugin Archiver plugin for WordPress
- All versions up to and including 2.0.4
- WordPress installations with the plugin activated
Discovery Timeline
- 2025-09-17 - CVE-2025-10188 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10188
Vulnerability Analysis
The plugin exposes a bulk_remove() function used to delete archived plugin directories under /wp-content. WordPress security best practice requires that state-changing actions verify a nonce token using wp_verify_nonce() or check_admin_referer(). The vulnerable code path performs directory deletion without confirming the request originated from an authorized administrative UI. As a result, any request that reaches the handler while an administrator session is active is trusted implicitly.
Root Cause
The root cause is missing or incorrect nonce validation on the bulk_remove() handler, classified as [CWE-352] Cross-Site Request Forgery. The plugin relies solely on cookie-based session authentication to authorize destructive filesystem operations. Because browsers automatically attach WordPress session cookies to cross-origin requests, an attacker-controlled page can invoke the handler on behalf of the administrator.
Attack Vector
Exploitation requires user interaction from an authenticated administrator. The attacker hosts a page containing an auto-submitting HTML form or image tag that issues a request to the vulnerable endpoint on the target WordPress site. When the administrator visits the page, the browser forwards session cookies and the plugin executes bulk_remove() against attacker-chosen directory identifiers. The impact is limited to integrity and availability of files under /wp-content, without direct code execution or data exfiltration.
No verified proof-of-concept code is published. See the Wordfence Vulnerability Report and the WordPress Plugin File for the current plugin source that includes the fix.
Detection Methods for CVE-2025-10188
Indicators of Compromise
- Unexpected removal of subdirectories under /wp-content, particularly plugin archive folders managed by Hack Repair Guy's Plugin Archiver.
- POST or GET requests to the plugin's admin endpoints originating from Referer headers outside the site's own domain.
- WordPress admin activity logs showing bulk removal actions without a corresponding administrator-initiated UI session.
Detection Strategies
- Monitor web server access logs for requests to the plugin's bulk action handler with off-site or missing Referer headers.
- Inspect filesystem audit trails for deletion events under wp-content correlated with administrator browser sessions.
- Deploy a web application firewall rule that blocks requests to the plugin endpoint lacking a valid WordPress nonce parameter.
Monitoring Recommendations
- Enable file integrity monitoring on the /wp-content directory to alert on unexpected deletions.
- Aggregate WordPress and web server logs into a centralized platform for correlation of administrator sessions with destructive actions.
- Review installed plugin versions on a recurring schedule and alert when versions at or below 2.0.4 are detected.
How to Mitigate CVE-2025-10188
Immediate Actions Required
- Update Hack Repair Guy's Plugin Archiver to version 3.1.1 or later on all WordPress instances.
- Deactivate and remove the plugin if it is not actively required for site operations.
- Instruct administrators to log out of WordPress before browsing untrusted sites or clicking unverified links.
Patch Information
The vendor addressed the CSRF flaw in version 3.1.1 by adding nonce validation to the bulk_remove() handler. Review the fixed source in the WordPress Plugin File for tag 3.1.1. Administrators should apply the update through the WordPress admin dashboard or via WP-CLI.
Workarounds
- Restrict access to /wp-admin using IP allowlisting at the web server or WAF layer until the plugin is updated.
- Require administrators to use a dedicated browser profile for WordPress administration with no unrelated browsing activity.
- Apply a WAF signature that rejects requests to the plugin endpoint when the _wpnonce parameter is absent or invalid.
# Update the plugin using WP-CLI
wp plugin update hackrepair-plugin-archiver --version=3.1.1
# Verify the installed version
wp plugin get hackrepair-plugin-archiver --field=version
# Deactivate the plugin if an update is not immediately possible
wp plugin deactivate hackrepair-plugin-archiver
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
