Acadlix LMS: Arbitrary file deletion (CVE-2026-103882)
The Acadlix LMS plugin for WordPress is vulnerable to arbitrary file deletion in the post_delete_assessment_file_by_id function due to insufficient file path validation and an improper permission callback, allowing unauthenticated attackers to delete files on the server.
CVE search metadata
CVE search record: CVE-2026-103882. Severity: critical. CVSS: 9.1. KEV: no. Product: Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin (<= 1.1.9). Brief: Acadlix LMS: Arbitrary file deletion (CVE-2026-103882). Brief link: https://feed.craftedsignal.io/briefs/2026-10-acadlix-lms-file-deletion/
Triage facts
Revision 1- Applicability
- Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin (<= 1.1.9)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Oct 31, 13:55 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Acadlix LMS - AI Quiz Maker, Online Exam & Course Plugin for WordPress (all versions up to and including 1.1.9) contains an arbitrary file deletion vulnerability in the post_delete_assessment_file_by_id function. The plugin's REST API permission callback only verifies a generic wp_rest nonce emitted in the public acadlixOptions JavaScript object, which effectively allows unauthenticated access. This vulnerability may lead to remote code execution by deleting critical files such as wp-config.php.