CVE-2025-10176: 
WordPress 脆弱性の分析と軽減

The Hack Repair Guy's Plugin Archiver plugin for WordPress contains a vulnerability (CVE-2025-10176) that affects all versions up to and including 2.0.4. The vulnerability was disclosed on September 12, 2025, and is related to insufficient file path validation in the prepare_items function (NVD).

The vulnerability is classified as an arbitrary file deletion issue due to insufficient file path validation in the prepare_items function. It has been assigned a CVSS v3.1 base score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability is categorized under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) (NVD, Wordfence).

When exploited, this vulnerability allows authenticated attackers with Administrator-level access to delete arbitrary files on the server. This capability can lead to remote code execution when critical files, such as wp-config.php, are deleted (NVD).

Users should update the Hack Repair Guy's Plugin Archiver plugin to a version newer than 2.0.4 when available. In the meantime, it is recommended to restrict administrator access and monitor file system activities (NVD).