The Hack Repair Guy's Plugin Archiver for WordPress contains a cross‑site request forgery flaw triggered by missing or incorrect nonce validation in the bulk_remove() function. An unauthenticated attacker can craft a forged request that, when a logged‑in administrator clicks a malicious link, causes the plugin to delete an arbitrary directory within the /wp-content folder. The vulnerability does not provide code execution but results in loss of site data and potentially site downtime.

The affected product is The Hack Repair Guy's Plugin Archiver for WordPress, versions up to and including 2.0.4. Any WordPress installation that has this plugin installed is vulnerable; no other vendors or products are listed.

The CVSS score of 5.4 places the flaw in the moderate range, and the EPSS score of less than 1% indicates a very low current likelihood of exploitation. It is not included in the CISA KEV catalog. The attack requires an attacker to fabricate a malicious link and persuade an administrator to click it while authenticated, so it is application‑level and dependent on social engineering rather than automated exploitation.