Acadlix LMS WordPress Plugin Arbitrary File Deletion Vulnerability

The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress is vulnerable to an arbitrary file deletion flaw due to insufficient file path validation in the post_delete_assessment_file_by_id function. All versions up to and including 1.1.9 are affected.

This makes it possible for attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted, such as wp-config.php.

• Affected versions: all versions up to and including 1.1.9
• Required access: authenticated attackers with subscriber-level access and above
• Actual authentication barrier: the route's permission callback only verifies a generic wp_rest nonce emitted inside the public acadlixOptions JavaScript object on every frontend page, effectively reducing the requirement to unauthenticated