{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/acadlix-lms--ai-quiz-maker-online-exam--course-plugin--1.1.9/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-103882"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Acadlix LMS – AI Quiz Maker, Online Exam \u0026 Course Plugin (\u003c= 1.1.9)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","arbitrary-file-deletion","rce"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Acadlix LMS - AI Quiz Maker, Online Exam \u0026amp; Course Plugin for WordPress (all versions up to and including 1.1.9) contains an arbitrary file deletion vulnerability in the post_delete_assessment_file_by_id function. The plugin's REST API permission callback only verifies a generic wp_rest nonce emitted in the public acadlixOptions JavaScript object, which effectively allows unauthenticated access. This vulnerability may lead to remote code execution by deleting critical files such as wp-config.php.\u003c/p\u003e\n","date_modified":"2026-10-31T13:55:16Z","date_published":"2026-10-31T13:55:16Z","id":"https://feed.craftedsignal.io/briefs/2026-10-acadlix-lms-file-deletion/","summary":"The Acadlix LMS plugin for WordPress is vulnerable to arbitrary file deletion in the post_delete_assessment_file_by_id function due to insufficient file path validation and an improper permission callback, allowing unauthenticated attackers to delete files on the server.","title":"Acadlix LMS: Arbitrary file deletion (CVE-2026-103882)","url":"https://feed.craftedsignal.io/briefs/2026-10-acadlix-lms-file-deletion/"}],"language":"en","title":"CraftedSignal Threat Feed - Acadlix LMS – AI Quiz Maker, Online Exam \u0026 Course Plugin (\u003c= 1.1.9)","version":"https://jsonfeed.org/version/1.1"}