CVE-2026-103882

Summary

The Acadlix LMS plugin for WordPress allows authenticated attackers with subscriber-level access (and effectively unauthenticated attackers due to flawed nonce validation) to delete arbitrary server files via insufficient path validation in the post_delete_assessment_file_by_id function, which can lead to remote code execution if critical files like wp-config.php are deleted.

Exploitability

Exploitation is straightforward for authenticated low-privilege users (subscriber or above), and even unauthenticated due to the plugin exposing a reusable nonce on every frontend page, making authentication bypass trivial.

Blast radius

Successful exploitation could result in full server compromise via deletion of core WordPress files (e.g., wp-config.php), enabling remote code execution and potential data exfiltration or site takeover.

Detection

Look for DELETE requests to the Acadlix REST endpoint (e.g., /wp-json/acadlix/v1/post_delete_assessment_file_by_id) containing suspicious file paths (e.g., containing ../ or targeting wp-config.php, .htaccess, or core plugin files), especially when originating from low-privilege users or unauthenticated sources.

Prioritized remediation

Upgrade to version 1.1.10 or later, where the plugin vendor has patched the insufficient file path validation and corrected the nonce-based permission check.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.