CRITICAL Score: 9.8/10

Vulnerability Summary

The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.1 via the 'contents' parameter. This is due to a lack of sanitization of user-supplied data when creating a cache file. This makes it possible for unauthenticated attackers to execute code on the server.

Technical Analysis

  • CVE ID: CVE-2025-12813
  • Published: 2025-11-11
  • Status: Active Threat

How to Fix & Protect

System administrators are advised to update the affected software immediately. Additionally, securing your network traffic prevents attackers from exploiting unpatched vulnerabilities remotely.

# Generic Patch Command
sudo apt update && sudo apt upgrade
Secure Your Traffic

Recommended Mitigation Tool

Sponsored Stories
Newer Older