CVE-2025-12813
Published: 11 November 2025
Description
The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.1 via the 'contents' parameter. This is due to a lack of sanitization of user-supplied data when creating a…
more
cache file. This makes it possible for unauthenticated attackers to execute code on the server.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the lack of sanitization of the user-supplied 'contents' parameter by enforcing validation of inputs before creating cache files, preventing arbitrary code execution.
Establishes a risk-based process to identify, prioritize, and remediate the RCE flaw in all versions of the Holiday class post calendar plugin up to 7.1.
Conducts periodic vulnerability scanning to detect the presence of CVE-2025-12813 in WordPress plugins and triggers remediation to prevent exploitation.
Security SummaryAI
CVE-2025-12813 is a Remote Code Execution vulnerability (CWE-94) in the Holiday class post calendar plugin for WordPress, affecting all versions up to and including 7.1. The issue stems from a lack of sanitization of user-supplied data passed via the 'contents' parameter when creating a cache file, allowing arbitrary code execution on the server. Published on 2025-11-11, it has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.
Unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful exploitation enables remote code execution on the web server hosting the vulnerable WordPress site, granting high-impact access to confidentiality, integrity, and availability.
Advisories from Wordfence provide detailed threat intelligence on the vulnerability, while the WordPress plugins trac repository offers source code context at line 1234 in holiday_class_post_calendar.php and a specific changeset documenting the issue.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2025-12813 is an unauthenticated RCE vulnerability in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications for initial access and code execution.