Log in / Sign up

Vulnerability details

CVE-2026-103882

acadlix LMS – AI Quiz Maker

Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter

CVSS 3.1
9.1Critical

Official description

The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The route's permission callback only verifies a generic wp_rest nonce that the plugin itself emits inside the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated.

CVSS scores

ScoreVersionSourceVector
9.1Critical 3.1 CVEProject cvelistV5 (CNA) (Wordfence) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected products

VendorProductVersionsSource
acadlix Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress v ≤ 1.1.9 CVEProject cvelistV5 (CNA)

References and advisories

5
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-10-31
Last updated
2026-11-05
State
Published
Assigner (CNA)
Wordfence
Kolun priority
28 · Low

Exploit prediction (EPSS)

0.78%
Probability of exploitation in 30 days
56.3%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
None
Technical impact
Partial

Weaknesses (CWE)

  • CWE-22
    Improper Limitation of a Pathname to a Restricted Directory