PT-2025-46297 · WordPress · Holiday Class Post Calendar Plugin

Kenneth Dunn · Published 2025-11-11 · Updated 2025-11-16 · CVE-2025-12813

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WordPress Holiday Class Post Calendar plugin versions up to and including 7.1

Description The Holiday Class Post Calendar plugin for WordPress is susceptible to Remote Code Execution via the contents parameter. This occurs because the plugin does not properly sanitize user-provided data when creating cache files. This allows unauthenticated attackers to execute code on the server. The issue enables code injection due to improper control of code generation.

Recommendations Update the plugin to a patched version if available. If no patch is available, disable and uninstall the vulnerable plugin instances.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-12813

Affected Products

Holiday Class Post Calendar Plugin

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-12813 · Security Note
• https://twitter.com/gothburz/status/1989861344800133209 · Twitter Post
• https://t.me/CVEtracker/37000 · Telegram Post
• https://plugins.trac.wordpress.org/browser/holiday-class-post-calendar/trunk/holiday_class_post_calendar.php#L1234 · Note
• https://twitter.com/CVEnew/status/1988095318995447891 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1988211629398380810 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3414925%40holiday-class-post-calendar&new=3414925%40holiday-class-post-calendar&sfp_email=&sfph_mail= · Note
• https://twitter.com/MNovofastovsky/status/1989345325375484354 · Twitter Post
• https://twitter.com/0dayPublishing/status/1988093054708797547 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/7f7968c4-589c-4949-9f69-4a0ba4db4ea9?source=cve · Note