PT-2025-38112 · WordPress · Plugin Archiver+1

Jonas Benjamin Friedli · Published 2025-09-17 · Updated 2025-09-17 · CVE-2025-10188

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions The Hack Repair Guy's Plugin Archiver plugin for WordPress versions up to and including 2.0.4

Description The Plugin Archiver plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the bulk remove() function. This allows unauthenticated attackers to perform arbitrary directory deletion in /wp-content via a forged request if they can trick a site administrator into performing an action, such as clicking a link.

Recommendations Update The Hack Repair Guy's Plugin Archiver plugin to a version later than 2.0.4. As a temporary workaround, restrict access to the bulk remove() function until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-10188

Affected Products

Plugin Archiver

Wordpress

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-10188 · Security Note
• https://t.me/cveNotify/135618 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1968270348173914298 · Twitter Post
• https://plugins.trac.wordpress.org/browser/hackrepair-plugin-archiver/tags/3.1.1/includes/bulk.php · Note
• https://t.me/CVEtracker/32712 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/51810981-5d2b-471b-b602-35809e281a0b?source=cve · Note
• https://twitter.com/CVEnew/status/1968190740556628072 · Twitter Post