{"id":"CVE-2026-103882","kind":"vulnerability","aliases":["CVE-2026-103882"],"related":[],"title":"Acadlix LMS WordPress plugin: arbitrary file deletion leads to code execution","description":"The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The route's permission callback only verifies a generic wp_rest nonce that the plugin itself emits inside the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated.","summary":"The Acadlix LMS WordPress plugin up to and including 1.1.9 lets a user delete arbitrary files on the server because file paths are not validated. Deleting a file such as wp-config.php can lead to remote code execution, and the nonce check can be satisfied by any visitor, so effectively no login is needed.","severity":"critical","cvss":9.1,"epss":0.00787,"exploited":false,"exploited_at":null,"products":[{"name":"acadlix","fixed":["1.2.0"],"affected":"<= 1.1.9","ecosystem":"wordpress-plugin"}],"ecosystems":["wordpress-plugin"],"tags":["acadlix","acadlix-lms","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","plugin-updated-to-1.2.0"],"how_to_check":"Run `wp plugin get acadlix --field=version` (slug is acadlix), or check Plugins in wp-admin. Version 1.1.9 or lower is vulnerable; 1.2.0 is the first release after 1.1.9. Look for wp-content/plugins/acadlix/.","fix":"Update the Acadlix LMS plugin (WordPress.org slug: acadlix) to 1.2.0 or later. The 1.2.0 changelog (23 Oct 2026) lists 'a security issue' reported by Wordfence; the vendor does not name the CVE or the file-deletion bug, so the mapping is inferred from the CVE affecting <= 1.1.9.","status":"open","published_at":"2026-10-31T09:16:32+00:00","first_seen_at":"2026-10-31T09:34:41+00:00","triaged_at":"2026-10-31T09:35:39+00:00","updated_at":"2026-10-31T18:03:04+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-31T09:35:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Acadlix LMS WordPress plugin: arbitrary file deletion leads to code execution","impact":"high","summary":"The Acadlix LMS WordPress plugin up to and including 1.1.9 lets a user delete arbitrary files on the server because file paths are not validated. Deleting a file such as wp-config.php can lead to remote code execution, and the nonce check can be satisfied by any visitor, so effectively no login is needed.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","acadlix-lms","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker deletes wp-config.php and gains code execution on the server","analyst_note":"Confirm a fixed plugin version and the plugin's WordPress.org slug from the NVD entry or the vendor's changelog; the sources give no fix.","how_to_check":"- Check the installed Acadlix LMS plugin version in the WordPress admin Plugins page or `wp plugin get acadlix-lms --field=version` if the plugin slug is acadlix-lms (unknown if the sources give the slug)\n- Look for the plugin under wp-content/plugins/ and confirm whether its version is 1.1.9 or lower","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Acadlix LMS WordPress plugin version 1.1.9 or earlier, where the plugin's REST routes are active. The sources say the nonce is printed on every frontend page, so a site with this plugin active is likely reachable without an account. Sites without the plugin can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000746,"input_tokens":4291,"output_tokens":633,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm a fixed plugin version and the plugin's WordPress.org slug from the NVD entry or the vendor's changelog; the sources give no fix.","search":"'-103882':14A,17A '-2026':13A,16A '1.1.9':37B,124C 'acadlix':1A,18A,19B,21B,29B,82C 'acadlix-lm':20B 'acadlixopt':183C 'access':136C 'ai':84C 'arbitrari':5A,42B,99C,141C 'assess':112C 'attack':131C 'authent':130C,193C 'callback':167C 'check':68B 'code':10A,63B,152C 'cours':89C 'cve':12A,15A 'delet':7A,41B,53B,101C,111C,140C,159C 'due':102C 'easili':148C 'effect':76B,190C 'emit':179C 'everi':187C 'exam':88C 'execut':11A,64B,153C 'file':6A,43B,48B,55B,100C,105C,113C,142C,157C 'frontend':188C 'function':116C 'generic':171C 'host':26B 'id':115C 'includ':36B,123C 'insid':180C 'insuffici':104C 'javascript':184C 'lead':8A,60B,149C 'let':38B 'level':135C 'lms':2A,22B,30B,83C 'login':78B 'make':126C 'maker':86C 'need':80B 'nonc':67B,174C 'object':185C 'onlin':87C 'packag':23B 'page':189C 'path':49B,106C 'permiss':166C 'plugin':4A,32B,90C,93C,177C 'possibl':128C 'post':110C 'public':182C 'quiz':85C 'reduc':191C 'remot':62B,151C 'requir':194C 'rest':173C 'right':156C 'rout':164C 'satisfi':71B 'self':25B 'self-host':24B 'server':46B,145C 'subscrib':134C 'subscriber-level':133C 'unauthent':196C 'user':40B 'valid':52B,107C 'verifi':169C 'version':119C 'visitor':74B 'vulner':97C 'wordpress':3A,27B,31B,92C,95C 'wp':172C 'wp-config.php':58B,162C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Acadlix LMS WordPress plugin version 1.1.9 or earlier, where the plugin's REST routes are active. The sources say the nonce is printed on every frontend page, so a site with this plugin active is likely reachable without an account. Sites without the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T09:16:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103882","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103882","severity":null,"published_at":"2026-10-31T09:16:32+00:00","modified_at":"2026-10-31T09:16:32+00:00","first_seen_at":"2026-10-31T09:34:41+00:00","fetched_at":"2026-10-31T09:34:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-103882:1232","url":null,"severity":null,"published_at":"2026-10-31T09:37:15+00:00","modified_at":"2026-10-31T09:37:15+00:00","first_seen_at":"2026-10-31T09:37:15+00:00","fetched_at":"2026-10-31T09:37:15+00:00","note":"Slug acadlix and 1.2.0 (23-10-2026) from wordpress.org/acadlix changelog + acadlix.com/changelog; vendor only says 'a security issue, thanks Wordfence', so the fix is inferred and not marked verified. Description says subscriber-level, but the nonce is public, so effectively unauthenticated (Wordfence title says Unauthenticated). No exploitation or PoC found; no social search done (new CVE)."},{"source":"epss","external_id":"CVE-2026-103882","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103882","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-31T18:03:04+00:00","fetched_at":"2026-10-31T18:03:04+00:00","note":null}],"documents":[{"id":31101,"url":"https://wordpress.org/plugins/acadlix/","title":"Acadlix LMS on WordPress.org (changelog 1.2.0, 1.1.9)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":31102,"url":"https://acadlix.com/changelog/","title":"Acadlix changelog","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":31103,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103882","title":"NVD CVE-2026-103882 (Wordfence CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}