CVE-2026-103882: Arbitrary file deletion in Acadlix WordPress plugin

WordPress plugin vulnerable to arbitrary file deletion up to v1.1.9. Critical severity CVSS 9.1.

CVE-2026-103882 is an arbitrary file deletion vulnerability in the Acadlix LMS – AI Quiz Maker, Online Exam & Course WordPress plugin. The post_delete_assessment_file_by_id function fails to properly validate file paths, allowing deletion of critical files on the server including wp-config.php, potentially enabling remote code execution. All versions up to and including 1.1.9 are affected.

The vulnerability carries a CVSS score of 9.1 and is classified as critical. The REST route's authentication control is compromised: the plugin emits a generic nonce publicly visible on every frontend page within the acadlixOptions JavaScript object, effectively downgrading the authentication requirement to unauthenticated. Disclosed October 31, 2026, social signals on X confirm active community awareness of this issue.

Defenders should immediately update the Acadlix LMS plugin to a version after 1.1.9 as soon as available. Until patched, protect critical files such as wp-config.php through server-level configuration. Disabling the plugin is a prudent immediate mitigation if timely patching is not feasible. Monitor REST API access logs for exploitation attempts.

At a glance

What: CVE-2026-103882: the post_delete_assessment_file_by_id function in Acadlix LMS plugin for WordPress fails to validate file paths, allowing deletion of arbitrary files on the server including wp-config.php, potentially enabling remote code execution.
Severity: CVSS 9.1 - Critical. The REST authentication nonce is publicly emitted within the acadlixOptions JavaScript object visible on every frontend page, effectively downgrading authentication to unauthenticated.
Affected versions: All versions up to and including 1.1.9
Fix: Not reported. Update the plugin as soon as a patched version becomes available.
Status: Disclosed October 31, 2026. Active reports on X confirm growing awareness of the vulnerability in the community.
Action: Update the plugin immediately to a version after 1.1.9. Protect critical files via server-level configuration. Disable the plugin if timely patching is not feasible. Monitor REST API access logs for exploitation attempts.

Sources: NVD, CVE-2026-103882

← All articles