Threats tagged 'ghsa-rqhh-g82f-mjjr'

The Acadlix LMS WordPress plugin up to version 1.1.9 contains an arbitrary file deletion vulnerability due to insufficient file path validation in a specific function. This flaw allows attackers with subscriber-level access or higher to delete arbitrary files on the server. The vulnerability is exacerbated by weak authentication controls, effectively allowing unauthenticated exploitation. Deleting critical files like wp-config.php can lead to remote code execution.