Arbitrary File Deletion Vulnerability in Acadlix LMS Plugin for WordPress

CVE-2026-103882

What is CVE-2026-103882?

The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress is susceptible to arbitrary file deletion due to insufficient validation of file paths in its post_delete_assessment_file_by_id function. This vulnerability allows authenticated users, with a minimum of subscriber-level access, to maliciously delete arbitrary files from the server. Such attacks can potentially lead to severe consequences like remote code execution through the deletion of critical files, for instance, wp-config.php. The compromised permission callback relies solely on a generic wp_rest nonce generated by the plugin itself, which undermines the authentication requirements and exposes the site to significant security risks.

References