{"id":"CVE-2026-103882","published":"2026-10-31T09:16:32.510","lastModified":"2026-10-31T09:16:32.510","description":"The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The route's permission callback only verifies a generic wp_rest nonce that the plugin itself emits inside the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/acadlix/tags/1.1.8/includes/Common/Assets/Manager.php#L570","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/acadlix/tags/1.1.8/includes/Common/REST/Front/FrontQuizController.php#L680","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/acadlix/tags/1.1.8/includes/Common/REST/Front/FrontQuizController.php#L692","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/acadlix/tags/1.1.8/includes/Common/REST/Front/FrontQuizController.php#L807","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b54682f6-914e-4c16-b8fb-63b5dcb14933?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Acadlix LMS plugin for WordPress allows authenticated attackers with subscriber-level access (and effectively unauthenticated attackers due to flawed nonce validation) to delete arbitrary server files via insufficient path validation in the post_delete_assessment_file_by_id function, which can lead to remote code execution if critical files like wp-config.php are deleted.","exploitability":"Exploitation is straightforward for authenticated low-privilege users (subscriber or above), and even unauthenticated due to the plugin exposing a reusable nonce on every frontend page, making authentication bypass trivial.","blast_radius":"Successful exploitation could result in full server compromise via deletion of core WordPress files (e.g., wp-config.php), enabling remote code execution and potential data exfiltration or site takeover.","remediation":"Upgrade to version 1.1.10 or later, where the plugin vendor has patched the insufficient file path validation and corrected the nonce-based permission check.","detection":"Look for DELETE requests to the Acadlix REST endpoint (e.g., /wp-json/acadlix/v1/post_delete_assessment_file_by_id) containing suspicious file paths (e.g., containing ../ or targeting wp-config.php, .htaccess, or core plugin files), especially when originating from low-privilege users or unauthenticated sources.","tags":["arbitrary-file-deletion","rce","auth-bypass","web","wordpress","path-traversal"],"model":"garnet-coder","analyzedAt":"2026-11-01T09:48:06.019Z"}}