CVE-2026-103882

The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The route's permission callback only verifies a generic wp_rest nonce that the plugin itself emits inside the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated.

• CWE-22

• https://plugins.trac.wordpress.org/browser/acadlix/tags/1.1.8/includes/Common/Assets/Manager.php#L570
• https://plugins.trac.wordpress.org/browser/acadlix/tags/1.1.8/includes/Common/REST/Front/FrontQuizController.php#L680
• https://plugins.trac.wordpress.org/browser/acadlix/tags/1.1.8/includes/Common/REST/Front/FrontQuizController.php#L692
• https://plugins.trac.wordpress.org/browser/acadlix/tags/1.1.8/includes/Common/REST/Front/FrontQuizController.php#L807
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b54682f6-914e-4c16-b8fb-63b5dcb14933?source=cve

Published

Oct 31, 2026

Last Modified

Nov 5, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103869A flaw was found in pulp-ansible's bearer-token refresh for …6.5
• CVE-2026-103870A flaw was found in pulp-rpm when it publishes a distributio…5
• CVE-2026-103875The Media Library Assistant plugin for WordPress is vulnerab…4.7
• CVE-2026-103877Deserialization of Untrusted Data vulnerability in Apache Di…9.8
• CVE-2026-103878Cleartext transmission of sensitive information vulnerabilit…7.5
• CVE-2026-103880Asymmetric Resource Consumption vulnerability in Apache Dire…7.5
• CVE-2026-103884A flaw was found in the X.509 client certificate authenticat…6.5
• CVE-2026-103885Asymmetric Resource Consumption vulnerability in Apache Dire…7.5
• CVE-2026-103888The WPC Smart Quick View for WooCommerce plugin for WordPres…6.1
• CVE-2026-103889The 3D Product configurator for WooCommerce plugin for WordP…9.8
• CVE-2026-103895The miniOrange OTP Login, Verification and SMS Notifications…8.1
• CVE-2026-103896The 10Web Booster – Website speed optimization, Cache & Page…7.5