The Hack Repair Guy's Plugin Archiver plugin contains insufficient file path validation in its prepare_items function, allowing authenticated administrators to delete arbitrary files on the server. Removing critical files such as wp-config.php can lead to remote code execution if the attacker deletes and replaces sensitive server files. This flaw is identified as CWE‑22, a path traversal or path manipulation weakness.

WordPress sites using The Hack Repair Guy's Plugin Archiver plugin, versions up to and including 2.0.4. The vulnerability affects all installations of the plugin regardless of configuration, as the path validation issue is in the core of the prepare_items routine.

The CVSS score of 7.2 indicates a high severity, and an EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must have authenticated administrator access, which is inferred from the description. Once authenticated, an attacker can craft a request to the prepare_items endpoint with a malicious file path to delete specific server files, potentially enabling remote code execution when critical files are removed.