The Hack Repair Guy's Plugin Archiver 2.0.4 contains insufficient file path validation in its prepare_items function, allowing authenticated administrators to delete arbitrary files on the server. Removing critical files such as wp-config.php can lead to remote code execution, as the attacker gains the ability to delete and replace server files or disrupt core functionality. This flaw is identified as CWE-22, a path traversal or path manipulation weakness.

WordPress sites using The Hack Repair Guy's Plugin Archiver plugin, versions up to and including 2.0.4. The vulnerability affects all installations of the plugin regardless of configuration, as the path validation issue is in the core of the prepare_items routine.

The CVSS score of 7.2 indicates a high severity, and an EPSS score of 2% suggests a moderate probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must have authenticated administrator access to the WordPress backend, which is the likely attack vector inferred from the description. Once authenticated, an attacker can craft a request to the prepare_items endpoint with a malicious file path to trigger deletion of critical server files.