CVE-2026-103882: Acadlix LMS Plugin — Critical Arbitrary File Deletion Enabling RCE

Executive Summary

A critical arbitrary file deletion vulnerability has been disclosed in the Acadlix LMS plugin for WordPress (AI Quiz Maker, Online Exam & Course Plugin). Tracked as CVE-2026-103882 with a CVSS 3.1 score of 9.1, the flaw affects all versions up to and including 1.1.9.

The post_delete_assessment_file_by_id function does not sufficiently validate file paths. The description states that users with subscriber-level access or higher can delete arbitrary files on the server, which can lead to remote code execution, for example by deleting wp-config.php. The route's permission check only verifies a generic REST nonce that the plugin publishes on every frontend page, so the authentication requirement is effectively removed. The CVSS vector reflects this with no privileges required.

CVSS Score: 9.1 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Vulnerability Overview

Root Cause

The REST handler in includes/Common/REST/Front/FrontQuizController.php accepts a file reference for an assessment attachment and deletes it without confining the resolved path to the intended upload directory. The permission callback only checks a REST nonce that includes/Common/Assets/Manager.php prints into every frontend page, so any visitor can obtain it.

Impact

Arbitrary file deletion is a well-known path to full compromise on WordPress:

1. Deleting wp-config.php forces WordPress into its installation flow, where an attacker can point the site at a database they control and create an administrator account
2. Deleting .htaccess or security plugin files removes access controls
3. Deleting core or plugin files can take the site offline

No confirmed in-the-wild exploitation was found at the time of writing, but this class of bug is quickly weaponized once details are public.

Remediation

Immediate Steps

1. Update Acadlix LMS to a version newer than 1.1.9 once released, or deactivate and remove it until then
2. Verify integrity of wp-config.php, .htaccess, and core files
3. Review web logs for REST requests to the plugin's quiz routes that include path traversal sequences
4. Check for unexpected administrator accounts if the site recently showed the installation screen

Hardening

• Block ../ and encoded traversal sequences at the WAF
• Make wp-config.php and core files read-only to the web server user where your deployment allows it
• Keep verified offsite backups so deleted files can be restored quickly

Detection

Key Takeaways

1. CVSS 9.1 Critical — arbitrary file deletion reachable with a publicly exposed nonce
2. All versions up to 1.1.9 are affected
3. A nonce is not authorization — a nonce exposed to every visitor does not protect a destructive route
4. Remove or update the plugin and confirm site file integrity

References

• NVD — CVE-2026-103882
• Wordfence Threat Intelligence entry
• OWASP — Path Traversal