Acadlix LMS WordPress Plugin: Critical CVE-2026-103882

What the flaw is and who it affectsThe Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress has been published in the National V...

What the flaw is and who it affects

The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress has been published in the National Vulnerability Database (NVD) of NIST with identifier CVE-2026-103882. The issue is an arbitrary file deletion weakness, classified as CWE-22 (improper limitation of a pathname to a restricted directory), caused by insufficient file path validation in the post_delete_assessment_file_by_id function.

Every version up to and including 1.1.9 is affected. The NVD entry, published on 31 October 2026, assigns a severity of CVSS 3.1 9.1 — CRITICAL, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

Two details make this worse than a typical plugin bug. First, the route's permission callback only checks a generic WordPress REST nonce that the plugin itself prints inside the public acadlixOptions JavaScript object on every frontend page. In practice, that lowers the bar from an authenticated subscriber to an effectively unauthenticated attacker. Second, deleting the right file can lead to remote code execution — the NVD text gives wp-config.php as an example.

Any WordPress site running Acadlix LMS, whether a small e-learning business in Lleida, a training academy in Barcelona or a corporate portal in Tarragona or Girona, should treat this as a priority. It applies equally to sites with an in-house IT contact and to those with no technical team at all.

Why it matters even without a known exploit

As of the NVD publication, CVE-2026-103882 does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalogue, so there is no public record of it being exploited in real attacks and no CISA remediation deadline attached to it.

That is not a reason to relax. A critical score with a network attack vector, low complexity and no privileges required means the barrier to abuse is low once someone reads the advisory. File deletion flaws are also destructive by nature: even without remote code execution, removing configuration or core files can take a shop or course platform offline and leave it in an inconsistent state that is awkward to recover. Under the GDPR, an outage or data loss on a site that processes student or customer records is also an availability and integrity problem you may have to document.

What to do today

Check whether the plugin is installed and at which version. In the WordPress admin, open the plugins list and read the version next to Acadlix LMS. Anything at 1.1.9 or below falls inside the affected range. If the plugin is inactive but present, it is still worth removing or updating.
Apply the fix indicated in the vendor's advisory. The NVD entry does not state which release corrects the flaw, so follow whatever the plugin author or the Wordfence threat intelligence entry specifies. If no fixed version is available yet, consider deactivating the plugin until one is.
Look for signs of intrusion. Review web server and WordPress logs for unexpected REST requests touching the assessment file deletion route, and check for missing or altered files, particularly configuration files. Compare against a known-good backup where you have one.
Reduce what is exposed to the internet. Restrict access to wp-admin and the REST API where your setup allows it, keep WordPress core, themes and other plugins patched, and make sure you hold recent, tested backups stored off the web server.

How a cybersecurity team can help

For a small business, the hard part is rarely reading the advisory — it is knowing which of a dozen plugins on three different sites is affected, and proving afterwards that nothing was touched. That is the kind of work ALMC's cybersecurity service is built around: security audits and pentesting to find weaknesses before they are used, server hardening, monitoring and incident response, and ongoing maintenance and updating of WordPress, PrestaShop and Joomla installations.

When a site has already been compromised, the same team handles repair of hacked websites and helps close the gap that allowed it. For companies in Catalonia running their own servers or leaning on a small IT team, that external pair of hands is often what turns a critical CVE from a worry into a scheduled task.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.