CVE-2026-103882
The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The route's permission callback only verifies a generic wp_rest nonce that the plugin itself emits inside the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated.
Properties
- First seen
- 2026-10-31T08:30:46+00:00
- Cvss score
- 9.1
- Last seen
- 2026-10-31T08:30:46+00:00
- Euvd assigner
- Wordfence
- Retrieved at
- 2026-10-31T13:34:22+00:00
- Src batch id
- euvd-20261031T133402Z-9a5f1a
- Source url
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-114675
- Score
- 9.1
- Euvd base score version
- 3.1
- Fetched at
- 2026-10-31T13:34:21+00:00
- Euvd vendor
- acadlix
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- First seen by Signal
- 2026-10-31T12:18:14+00:00
- Euvd base score
- 9.1
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- Content hash
- 89030a076397b7a30e7309d9edffc09685d3b8e42b56562f8ea25aa63b7bf8d2
- Published at
- 2026-10-31T09:16:32.510
- Euvd updated
- 2026-10-31T08:30:46+00:00
- Last modified
- 2026-10-31T09:16:32.510
- Euvd epss pct
- 0
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph