CVE-2026-103882: Acadlix LMS Plugin File Deletion Flaw

A critical vulnerability, tracked as CVE-2026-103882, has been published for the Acadlix LMS - AI Quiz Maker, Online Exam & Course plugin for WordPress. According to the GitHub Advisory Database entry, all versions up to and including 1.1.9 allow arbitrary file deletion on the server. The CVSS score is 9.1 (critical).

If you run a WordPress site that offers quizzes, exams or courses with this plugin, check your version today. The advisory notes that deleting the right file, such as wp-config.php, can easily lead to remote code execution. The available sources do not name a fixed version, so the guidance below focuses on what you can verify and control.

What was reported

The advisory describes an arbitrary file deletion issue caused by insufficient file path validation in a function named post_delete_assessment_file_by_id. It was published on October 31, 2026 by the National Vulnerability Database and the GitHub Advisory Database. The weakness is classified as CWE-22, improper limitation of a pathname to a restricted directory, commonly called path traversal.

The GitHub listing is marked unreviewed and shows affected and patched versions as unknown. The only version statement comes from the description itself: everything up to and including 1.1.9 is affected. The NVD page repeats the same text, so it is not a second, independent confirmation. The advisory also points to a Wordfence threat intelligence entry and to plugin source code for version 1.1.8 in the WordPress.org repository.

How the weakness works

Path traversal bugs happen when a plugin builds a file path from user-supplied input without confirming the result stays inside an intended folder. Here, the affected function deals with assessment-related files, but the path validation is insufficient, so files elsewhere on the server can be deleted.

The second part of the problem is access control. The advisory says the REST route's permission callback only verifies a generic wp_rest nonce. A nonce is a token WordPress uses to confirm a request came from a legitimate page. According to the advisory, the plugin itself prints this nonce in a public JavaScript object called acadlixOptions on every frontend page. In practice, anyone who can load a page on the site can read the token.

That is why the description says the authentication requirement is effectively reduced to unauthenticated, even though it formally speaks of subscriber-level access and above. The CVSS vector agrees, listing privileges required as none. Subscriber accounts are also easy to obtain on sites with open registration, which is common for course and exam platforms.

Why wp-config.php deletion matters

The advisory singles out wp-config.php as an example of a file whose deletion can easily lead to remote code execution. This file holds your site's core configuration, including its database connection settings. The advisory does not describe a specific exploit chain, and we are not adding one. Deleting other files could also disrupt or weaken a site, but the sources do not detail such scenarios.

Who is exposed

• Any WordPress site with the Acadlix LMS plugin installed at version 1.1.9 or earlier. The advisory says the nonce appears on every frontend page, which suggests exposure is not limited to quiz pages. The sources do not say whether an inactive plugin is affected, so treat any installed copy as a concern.
• Sites that allow open user registration, since a low-privilege account is easy to create. Based on the advisory text, even this may not be necessary.
• Agencies and hosts managing many WordPress sites, where an LMS plugin may have been installed by a client and forgotten.

The sources do not say whether attacks are happening. Treat that as unknown rather than as a sign of safety. For a critical plugin bug with a public description, it is prudent to act as if scanning could begin quickly.

How to check your exposure

1. Log in to WordPress and open Plugins, then look for Acadlix LMS - AI Quiz Maker, Online Exam & Course. Note the installed version.
2. If you manage sites from the command line, list installed plugins and versions with WP-CLI and look for the acadlix slug.
3. Visit the plugin's page on WordPress.org and the vendor's changelog to see whether a version newer than 1.1.9 has been released, and read its notes for a mention of this issue.
4. Check the list of known WordPress plugin vulnerabilities and the Wordfence entry for updates on patched versions.
5. Confirm that wp-config.php, .htaccess and your core files are still present. The sources do not publish the route or request details, so there is no specific log signature to search for. Instead, review web server logs for unexpected requests to /wp-json/ and for unexplained file deletions, missing files or errors around the time of disclosure.

For a broader walkthrough, see our guide on whether your WordPress plugin is vulnerable.

What to do now

Because no fixed version is named in the available sources, your first step is to find out whether one exists. The order below is conservative.

1. Take a full backup of files and database and store it off the server. Do this first, since the flaw allows files to be deleted.
2. Check for a plugin update beyond 1.1.9. If one is available and its changelog addresses this issue, update right away, ideally on staging first if you can do so quickly.
3. If no fix is available, deactivate and remove the plugin until one is released. Removing it is the safest option because it eliminates the vulnerable code from your site. If you cannot remove it because courses must stay online, treat the next steps as essential rather than optional.
4. Turn off open registration if you do not need it, and review recently created subscriber accounts for ones you do not recognize.
5. Consider a web application firewall rule that restricts access to the plugin's REST endpoints from untrusted sources. Test carefully so you do not break legitimate quiz use. See what a WAF is for background.
6. Make sure file permissions are tight, so the web server user cannot modify more than it needs. Moving wp-config.php one directory above the web root is a supported WordPress option that can add some protection, although it does not fix the underlying bug.
7. If you find missing core files or other signs of tampering, follow our website hacked checklist.

Detection and monitoring afterwards

File deletion is easy to miss until a page breaks. Set up uptime checks so an unexpected error page alerts you quickly. Uptime monitoring is useful here, and Webforta Monitor can track availability, certificate, DNS and header changes, though it does not identify this specific flaw.

Also keep file integrity tooling or hosting-level snapshots in place so you can compare current files with a known good copy. Watch the vendor changelog, the GitHub advisory and the Wordfence page for fixed-version information, and re-check your site once a patch is out. For ongoing habits that limit the impact of any plugin flaw, work through our WordPress security checklist.

What is still unclear

• No patched version is named in the available sources.
• The GitHub entry is unreviewed and the information comes from a single original disclosure, repeated by NVD.
• No source here reports active exploitation, and none provides a proof of concept. The CVE is not marked in CISA's Known Exploited Vulnerabilities data in the research provided.
• The sources do not say who discovered the issue or when the vendor was notified.

Treat these points as open until the vendor or another primary source confirms them.

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

• CVE-2026-103882 - GitHub Advisory Database (github.com)
• CVE-2026-103882: The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient… (nvd.nist.gov, 31 October 2026)

Tags: WordPress, CVE-2026-103882, Acadlix, path traversal, plugin security