Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability exists in a WordPress plugin that allows for arbitrary file deletion on the server, potentially leading to remote code execution. This issue affects the Acadlix LMS plugin, specifically its AI Quiz Maker, Online Exam & Course functionalities. While detailed exploitation requires further analysis, the core concern is the potential for unauthorized server access and data compromise.
- Attackers can delete any file on the server.
- Confirms relevance and exposure of this plugin.
- Assess risk and confirm plugin usage.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this vulnerability by sending a request to the affected WordPress plugin. This request, when processed by the `post_delete_assessment_file_by_id` function, fails to properly validate file paths, allowing the attacker to delete arbitrary files on the server. Deleting critical files like `wp-config.php` could lead to remote code execution.
- Unauthenticated network access to the site.
- Deleting arbitrary files via a REST API endpoint.
- Remote code execution via critical file deletion.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an unauthenticated attacker to delete arbitrary files on the server. When supported by the advisory, deleting critical files like configuration files could lead to remote code execution.
- Server files
- Via a network request
- Remote code execution
Operational Fix
Recommended remediation, mitigation, and detection steps
Application owners and infrastructure teams are likely responsible for addressing this vulnerability in the WordPress plugin. The first practical step is to identify all instances of the affected plugin, confirm their exposure and business criticality, and then engage the accountable team for remediation planning.
- Plugin owners should manage remediation efforts.
- Verify plugin reachability and criticality first.
- Plan remediation based on confirmed risk.
