CVE-2026-103882 in LMS Plugin
Summary
by MITRE • 10/31/2026
The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The route's permission callback only verifies a generic wp_rest nonce that the plugin itself emits inside the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress contains a critical security vulnerability affecting all versions up to and including 1.1.9. This flaw is classified as an arbitrary file deletion issue resulting from insufficient validation of file paths within the post_delete_assessment_file_by_id function. The severity of this vulnerability is significantly amplified by its potential impact on system integrity, specifically through the removal of critical configuration files such as wp-config.php, which can lead directly to remote code execution under specific conditions.
The technical root cause lies in how the plugin handles file path parameters during deletion requests. When a user initiates an assessment file deletion, the backend function responsible for processing this request fails to adequately sanitize or validate the provided file path. This lack of rigorous input validation allows attackers to manipulate the path parameter to reference files outside the intended directory structure. By utilizing relative paths such as ../../wp-config.php, an attacker can bypass standard access controls and target sensitive system files that are not part of the plugin's designated storage area.
A critical aspect of this vulnerability is its authentication requirements. While the vulnerability technically requires authenticated access with subscriber-level permissions or higher to trigger the deletion function, the implementation of these checks is flawed. The route's permission callback relies solely on a generic WordPress REST nonce for verification. This nonce is emitted by the plugin itself within the acadlixOptions JavaScript object and is accessible on every frontend page served by the website. Consequently, any visitor who can load a page containing this script possesses the necessary credentials to authenticate their requests as valid administrative actions. This effectively reduces the authentication barrier from authenticated user access to unauthenticated exploitation, allowing external attackers with no prior login credentials to execute malicious file deletion operations.
The operational impact of this vulnerability is severe and multifaceted. The immediate consequence is the arbitrary deletion of files on the server hosting the WordPress installation. If an attacker targets wp-config.php, they can destroy the database connection settings and security keys, causing a complete denial of service for the website as it becomes unable to connect to its backend data store. More critically, if other writable or executable files are deleted in specific contexts, such as removing essential framework components or cache files that influence application behavior, an attacker may achieve remote code execution. This could allow them to inject malicious scripts, deface the site, or use the compromised server as a pivot point for further attacks against internal networks.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-650: Trust Boundary Violation due to insufficient verification of user-supplied input before performing critical operations like file deletion. In terms of the MITRE ATT&CK framework for enterprise security, this behavior corresponds to T1485: Data Destruction, where an adversary deletes data or destroys a system component. The ability to escalate from unauthenticated access to arbitrary file manipulation represents a significant breach in trust boundaries and input validation protocols commonly expected in secure software development practices.
Mitigation strategies must address both the immediate technical flaw and broader security hygiene. For administrators using affected versions of the Acadlix LMS plugin, the primary remediation is to upgrade to version 1.2.0 or later where this path validation issue has been resolved by developers implementing strict allow-listing for file paths and ensuring that only expected directories are accessible for deletion operations. Until an update can be applied, administrators should consider restricting access to WordPress admin pages via IP whitelisting if possible, although the unauthenticated nature of the exploit limits the efficacy of this measure against external attackers who do not need login credentials but rather valid REST nonces exposed in public HTML sources.
Furthermore, implementing a Web Application Firewall (WAF) can provide an additional layer of defense by detecting and blocking requests that contain path traversal sequences such as ../ or attempts to access sensitive filenames like wp-config.php within API endpoints. It is also advisable to review server-level permissions to ensure that the web server process does not have write access to critical configuration files, thereby mitigating the risk even if a deletion attempt succeeds. Regular security audits and penetration testing of WordPress plugins are essential to identify similar flaws in input validation logic before they can be exploited by malicious actors seeking to compromise system integrity.