CVE-2025-10176 is a path traversal vulnerability (CWE-22) in The Hack Repair Guy's Plugin Archiver WordPress plugin (versions up to 2.0.4). The flaw arises from inadequate validation of file paths in the prepare_items function, enabling authenticated users with Administrator privileges or higher to delete arbitrary files on the server. This can lead to severe consequences including remote code execution if critical files like wp-config.php are deleted. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity. No known exploits are reported in the wild, and no patch or remediation details are provided at this time.

An attacker with Administrator-level access can delete arbitrary files on the server due to improper path validation. This can compromise the integrity and availability of the WordPress installation, and may lead to remote code execution if key files such as wp-config.php are deleted. The vulnerability affects confidentiality, integrity, and availability, with a high CVSS score of 7.2.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to file deletions within the plugin. Avoid using versions up to and including 2.0.4 if possible.