CVE-2026-103882
Received Received - Intake

Arbitrary File Deletion in Acadlix LMS WordPress Plugin

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The route's permission callback only verifies a generic wp_rest nonce that the plugin itself emits inside the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-103882
EUVD
EUVD-2026-114675

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
acadlix Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Acadlix LMS plugin for WordPress has a vulnerability in the post_delete_assessment_file_by_id function that allows arbitrary file deletion due to insufficient file path validation. This flaw affects versions up to 1.1.9 and enables authenticated attackers with subscriber-level access or higher to delete any file on the server. Deleting critical files like wp-config.php could lead to remote code execution.

Detection Guidance

Check for unauthorized file deletions in WordPress directories, especially wp-config.php. Review server logs for suspicious activity from subscriber-level accounts. Inspect plugin versions to confirm if Acadlix LMS is running versions up to 1.1.9.

Impact Analysis

This vulnerability allows attackers to delete important files on your WordPress server, potentially causing system crashes, data loss, or unauthorized code execution. If an attacker deletes wp-config.php, they could gain full control of your WordPress site, leading to complete compromise of your website and data.

Compliance Impact

This vulnerability allows authenticated attackers to delete arbitrary files on the server, which could include sensitive data files or configuration files like wp-config.php. Such unauthorized file deletion could lead to data breaches or system compromise, violating GDPR's integrity and confidentiality requirements and HIPAA's safeguards for protected health information.

Mitigation Strategies

Update the Acadlix LMS plugin to the latest version beyond 1.1.9 immediately. Remove subscriber-level access for untrusted users. Monitor server files for unauthorized changes and restrict file deletion permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103882. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart