https://feed.craftedsignal.io/products/acadlix-lms--ai-quiz-maker-online-exam--course-plugin--1.1.9/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 13:55:16 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-acadlix-lms-file-deletion/Sat, 31 Oct 2026 13:55:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-acadlix-lms-file-deletion/The Acadlix LMS plugin for WordPress is vulnerable to arbitrary file deletion in the post_delete_assessment_file_by_id function due to insufficient file path validation and an improper permission callback, allowing unauthenticated attackers to delete files on the server.<p>The Acadlix LMS - AI Quiz Maker, Online Exam &amp; Course Plugin for WordPress (all versions up to and including 1.1.9) contains an arbitrary file deletion vulnerability in the post_delete_assessment_file_by_id function. The plugin's REST API permission callback only verifies a generic wp_rest nonce emitted in the public acadlixOptions JavaScript object, which effectively allows unauthenticated access. This vulnerability may lead to remote code execution by deleting critical files such as wp-config.php.</p> criticaladvisorywordpressarbitrary-file-deletionrce