Acadlix Lms Ai Quiz Maker Online Exam Course Plugin For Wordpress
Monthly
Unauthenticated arbitrary file deletion in the Acadlix LMS - AI Quiz Maker, Online Exam & Course plugin for WordPress (all versions up to and including 1.1.9) allows remote attackers to remove any file the web server can write or unlink, rated CVSS 9.1. The plugin registers a frontend REST route, post_delete_assessment_file_by_id, whose permission callback only validates a generic wp_rest nonce that the plugin itself publishes inside the public acadlixOptions JavaScript object on every frontend page, so an attacker can harvest the nonce from any public page and then submit a traversal path - the nominal subscriber-level requirement is effectively void, matching the PR:N vector. Deleting a sensitive file such as wp-config.php can take the site down or force a reinstall flow that frequently ends in remote code execution; no public exploit identified at time of analysis, but the priority label is act_now given the trivial prerequisites and destructive impact. No CISA KEV entry is associated with this CVE.
Unauthenticated arbitrary file deletion in the Acadlix LMS - AI Quiz Maker, Online Exam & Course plugin for WordPress (all versions up to and including 1.1.9) allows remote attackers to remove any file the web server can write or unlink, rated CVSS 9.1. The plugin registers a frontend REST route, post_delete_assessment_file_by_id, whose permission callback only validates a generic wp_rest nonce that the plugin itself publishes inside the public acadlixOptions JavaScript object on every frontend page, so an attacker can harvest the nonce from any public page and then submit a traversal path - the nominal subscriber-level requirement is effectively void, matching the PR:N vector. Deleting a sensitive file such as wp-config.php can take the site down or force a reinstall flow that frequently ends in remote code execution; no public exploit identified at time of analysis, but the priority label is act_now given the trivial prerequisites and destructive impact. No CISA KEV entry is associated with this CVE.