CVE-2025-10176: 
WordPress vulnerability analysis and mitigation

CVE-2025-10176 is an arbitrary file deletion vulnerability in The Hack Repair Guy's Plugin Archiver plugin for WordPress, caused by insufficient file path validation in the prepare_items function. All versions up to and including 2.0.4 are affected. The flaw allows authenticated attackers with Administrator-level access to delete arbitrary files on the server, which can lead to remote code execution (e.g., by deleting wp-config.php to trigger WordPress reinstallation). It was published on September 12, 2025, with a CVSS v3.1 base score of 7.2 (High) (Wordfence, Red Hat CVE).

The root cause is a path traversal flaw (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) in the prepare_items function within includes/list.php of the Plugin Archiver plugin. Due to insufficient validation of user-supplied file path input, an authenticated administrator can craft requests that traverse outside the intended directory and target arbitrary files on the server filesystem. The attack vector is network-based, requires no user interaction, and has low attack complexity, though it does require high privileges (Administrator-level authentication). Exploitation can escalate to remote code execution by deleting critical WordPress configuration files such as wp-config.php, which triggers the WordPress setup wizard and allows an attacker to reconfigure the database connection (Wordfence, Plugin Source).

Successful exploitation allows an authenticated administrator to delete any file accessible by the web server process, including critical WordPress files. Deleting wp-config.php can lead to full remote code execution by enabling an attacker to reconfigure the WordPress installation, effectively taking over the site and its underlying server. This results in high confidentiality, integrity, and availability impact, potentially exposing sensitive database credentials and enabling persistent access or lateral movement within the hosting environment (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability requires Administrator-level authentication, which limits the attack surface to compromised or malicious admin accounts. The EPSS score is approximately 0.73%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Gain Administrator Access: Obtain WordPress administrator credentials through phishing, credential stuffing, or by exploiting another vulnerability that grants admin-level access.
2. Navigate to Plugin Archiver: Log into the WordPress admin dashboard and access the Plugin Archiver plugin's management interface.
3. Craft Malicious File Path: In the plugin's file listing or deletion functionality (the prepare_items function in includes/list.php), supply a path-traversal payload (e.g., ../../wp-config.php) as the target file parameter, bypassing the insufficient path validation.
4. Delete Critical File: Submit the crafted request to delete wp-config.php or another critical server file. WordPress will detect the missing configuration file and display the installation wizard.
5. Achieve Remote Code Execution: Use the WordPress setup wizard to reconfigure the database connection to an attacker-controlled database, then log in as a new administrator and upload a malicious plugin or theme containing a web shell to achieve full server-side code execution (Wordfence, Plugin Source).

• Logs: WordPress access logs showing admin-authenticated POST or GET requests to Plugin Archiver admin pages with path traversal sequences (e.g., ../, %2e%2e%2f) in file path parameters; sudden appearance of WordPress installation wizard requests (/wp-admin/setup-config.php or /wp-admin/install.php) indicating wp-config.php deletion.
• File System: Unexpected absence of wp-config.php or other core WordPress files; new or modified plugin/theme files containing obfuscated PHP code or web shells following the incident.
• Process: Unusual PHP or web server child processes spawned after the deletion event, particularly those initiating outbound network connections.

The primary remediation is to update The Hack Repair Guy's Plugin Archiver plugin to a version beyond 2.0.4 that includes proper file path validation. If no patched version is yet available, administrators should deactivate and remove the plugin immediately. Additionally, applying the principle of least privilege — limiting the number of accounts with WordPress Administrator access — reduces the risk of exploitation. Monitoring admin activity logs for unusual file operations is recommended as a compensating control (Wordfence, Wordfence Weekly Report).

Wordfence disclosed and reported the vulnerability as part of their weekly WordPress vulnerability intelligence report for the week of September 8–14, 2025. The vulnerability received brief coverage on security aggregation platforms and social media accounts focused on CVE tracking (e.g., Offseq on Mastodon and Bluesky). No significant vendor statements beyond the Wordfence advisory or notable researcher commentary have been identified (Wordfence Weekly Report).