Acadlix LMS CVE-2026-103882

Exploitable against the Acadlix LMS plugin (all versions up to and including 1.1.9) whenever the plugin is active, because its frontend REST route post_delete_assessment_file_by_id (FrontQuizController) guards deletion with only a wp_rest nonce that the plugin emits in the public acadlixOptions JavaScript object on every frontend page. The practical prerequisite is trivial: fetch any public page to harvest that nonce, then call the endpoint with a traversal path. The nominal 'subscriber-level and above' requirement is effectively nullified by the leaked nonce (consistent with PR:N). The only real limiters are that the plugin must be installed and active and that escalation to RCE depends on deleting a file whose removal is impactful (e.g., wp-config.php); the arbitrary file deletion itself needs no special configuration.

Signals align toward high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity flaw, and the vuln.today decision label is act_now, reported by Wordfence (a credible WordPress-focused source). The description explains WHY PR:N is justified: the REST route's permission callback only verifies a generic wp_rest nonce that the plugin itself publishes inside the public acadlixOptions JavaScript object on every frontend page, so the nominal 'subscriber-level and above' requirement collapses to effectively unauthenticated. The I:H/A:H impact reflects arbitrary file deletion that can escalate to RCE when a critical file such as wp-config.php is removed. Tempering factors: no EPSS score was provided, this CVE is NOT listed in CISA KEV, and no confirmed public exploit code was supplied - the references are the Wordfence advisory and WordPress trac source lines, not a weaponized PoC. So despite the act_now label and 9.1 score, there is no evidence yet of real-world exploitation; treat urgency as driven by ease of exploitation and impact rather than observed attacks. Note also that the input lists no fixed version, which should be verified with the vendor before relying on an upgrade.

An attacker loads any public page of a WordPress site running the plugin, scrapes the wp_rest nonce exposed in the acadlixOptions JavaScript object, then sends a crafted request to the post_delete_assessment_file_by_id REST route supplying a traversal path. By deleting wp-config.php (or another sensitive file), the attacker can force WordPress into a setup/installer state and pivot to remote code execution. No confirmed public exploit code was provided, though the Wordfence advisory and WordPress trac source references document the vulnerable function.