CVE-2026-103882 is a critical (CVSS 9.1) path traversal flaw in the Acadlix LMS WordPress plugin that lets attackers delete arbitrary files on the server. According to the vulnerability description published by NVD and the CNA, Wordfence, the plugin exposes its own nonce publicly, which would make the subscriber-level authentication requirement effectively unenforced.
What Is It
CVE-2026-103882 is an arbitrary file deletion flaw in the Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress. The cause is insufficient file path validation in the post_delete_assessment_file_by_id function, classified as CWE-22 (Path Traversal).
According to the NVD description, the flaw requires subscriber-level access or higher. However, the advisory states that the REST route's permission callback only checks a generic wp_rest nonce, and that the plugin prints that nonce inside the public acadlixOptions JavaScript object on every frontend page. If that is accurate, anyone who can load the site could get a valid nonce, and the authentication requirement would be effectively removed. The CVSS vector assigned by the CNA reflects this assessment with Privileges Required: None.
Why It Matters
- Severity: CVSS 3.1 base score 9.1 (CRITICAL). Vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. - Exploitability: The attack runs over the network, has low complexity, and needs no privileges or user interaction.
- Impact: The flaw has high integrity and availability impact. The NVD notes that deleting the right file, such as
wp-config.php, "can easily lead to remote code execution." - Exploitation status: The supplied CISA KEV entry is empty, so the data provided does not confirm active exploitation in the wild.
Because the advisory reports that a valid nonce is publicly exposed, this flaw is likely far easier to reach than a typical bug that needs subscriber-level access.
What's Vulnerable
- Vendor: acadlix
- Product: Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress
- Affected versions: All versions up to and including 1.1.9
The CNA, Wordfence, lists the default status as unaffected outside this range. The NVD record lists no CPEs yet, and its status is "Received" (published 2026-10-31).
Patch Status
The supplied NVD record does not name a fixed version, and no CISA KEV required action or due date is listed. Administrators running Acadlix LMS 1.1.9 or earlier should:
- Check the Wordfence advisory and the WordPress plugin repository for a release later than 1.1.9.
- Update as soon as a fixed version is available.
- Consider deactivating the plugin until a patched version is confirmed.