CVE-2026-103882

Name of the Vulnerable Software and Affected Versions Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress versions prior to 1.2.0

Description Insufficient file path validation in the post delete assessment file by id() function allows for arbitrary file deletion on the server. Although the plugin intends to require authenticated access, the permission callback only verifies a generic nonce emitted in the public acadlixOptions JavaScript object on frontend pages, effectively allowing unauthenticated attackers to exploit the issue. Deleting critical files, such as wp-config.php, can lead to remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.