Summary
generated automatically from NVD dataThe Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress, in all versions up to and including 1.1.9, has an arbitrary file deletion flaw (CWE-22) caused by insufficient path validation in the post_delete_assessment_file_by_id function. Subscriber-level users can delete server files such as wp-config.php, which can lead to remote code execution. Because the route only checks a generic wp_rest nonce exposed in the public acadlixOptions JavaScript object, authentication is effectively unnecessary. The CVSS v3.1 score is 9.1 (CRITICAL).
NVD description
The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The route's permission callback only verifies a generic wp_rest nonce that the plugin itself emits inside the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated.
EPSS · FIRST.org
0.79%probability of exploitation in the next 30 days
Higher than 56% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-31, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 31 oct. 2026
- Updated
- 31 oct. 2026
- Status
- Received
- Source
- security@wordfence.com
Weaknesses (CWE)
References (5)
Similar CVEs
Other vulnerabilities of type CWE-22
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.