Live › vulnerability › CVE-2026-103882
The Acadlix LMS WordPress plugin up to and including 1.1.9 lets a user delete arbitrary files on the server because file paths are not validated. Deleting a file such as wp-config.php can lead to remote code execution, and the nonce check can be satisfied by any visitor, so effectively no login is needed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 09:34 UTC. All times on this page are UTC.
Sites running the Acadlix LMS WordPress plugin version 1.1.9 or earlier, where the plugin's REST routes are active. The sources say the nonce is printed on every frontend page, so a site with this plugin active is likely reachable without an account. Sites without the plugin can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| acadlix | wordpress-plugin | <= 1.1.9 | 1.2.0 |
Run wp plugin get acadlix --field=version (slug is acadlix), or check Plugins in wp-admin. Version 1.1.9 or lower is vulnerable; 1.2.0 is the first release after 1.1.9. Look for wp-content/plugins/acadlix/.
1.2.01.2.0 changelog (23 Oct 2026) lists a security issue reported by Wordfence; the vendor does not name the CVE or the file-deletion bug, so the mapping is inferred from the CVE affecting <= 1.1.9Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The route's permission callback only verifies a generic wp_rest nonce that the plugin itself emits inside the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated.
This page as .md · .json · in your agent: get_signal("CVE-2026-103882")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.